我正在尝试在我的ASP上启用跨起源资源共享。NET核心Web API，但我卡住了。
EnableCors属性接受字符串类型的policyName作为参数:
// Summary:
// Creates a new instance of the Microsoft.AspNetCore.Cors.Core.EnableCorsAttribute.
//
// Parameters:
// policyName:
// The name of the policy to be applied.
public EnableCorsAttribute(string policyName);
policyName是什么意思，如何在ASP上配置CORS。NET核心Web API?
当前回答
特别是在dotnet核心2.2中，你必须改变SignalR
.WithOrigins (http://localhost: 3000)或
.SetIsOriginAllowed(isOriginAllowed: _ => true) //所有源
用.AllowCredentials()代替。allowanyorigin ()
https://trailheadtechnology.com/breaking-change-in-aspnetcore-2-2-for-signalr-and-cors/
https://github.com/aspnet/AspNetCore/issues/4483
其他回答
得到这个工作与。net Core 3.1如下
确保你把UseCors代码放在app.UseRouting()之间;和app.UseAuthentication ();
app.UseHttpsRedirection();
app.UseRouting();
app.UseCors("CorsApi");
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints => {
endpoints.MapControllers();
});
然后将此代码放在ConfigureServices方法中
services.AddCors(options =>
{
options.AddPolicy("CorsApi",
builder => builder.WithOrigins("http://localhost:4200", "http://mywebsite.com")
.AllowAnyHeader()
.AllowAnyMethod());
});
在基本控制器上面我放了这个
[EnableCors("CorsApi")]
[Route("api/[controller]")]
[ApiController]
public class BaseController : ControllerBase
现在我所有的控制器都将继承BaseController，并启用CORS
特别是在dotnet核心2.2中，你必须改变SignalR
.WithOrigins (http://localhost: 3000)或
.SetIsOriginAllowed(isOriginAllowed: _ => true) //所有源
用.AllowCredentials()代替。allowanyorigin ()
https://trailheadtechnology.com/breaking-change-in-aspnetcore-2-2-for-signalr-and-cors/
https://github.com/aspnet/AspNetCore/issues/4483
ASP。NET Core 6:
var MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddCors(options =>
{
options.AddPolicy(name: MyAllowSpecificOrigins,
builder =>
{
builder.WithOrigins("http://example.com",
"http://www.contoso.com");
});
});
// services.AddResponseCaching();
builder.Services.AddControllers();
var app = builder.Build();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseCors(MyAllowSpecificOrigins);
app.UseAuthorization();
app.MapControllers();
app.Run();
更多样品请参考官方文档。
ASP。NET Core 3.1和5.0:
你必须在应用程序启动时在ConfigureServices方法中配置CORS策略:
public void ConfigureServices(IServiceCollection services)
{
services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
{
builder.WithOrigins("http://example.com")
.AllowAnyMethod()
.AllowAnyHeader();
}));
// ...
}
builder中的CorsPolicyBuilder允许您根据需要配置策略。你现在可以使用这个名字将策略应用到控制器和动作上:
[EnableCors("MyPolicy")]
或者把它应用到每一个请求上:
public void Configure(IApplicationBuilder app)
{
app.UseCors("MyPolicy");
// ...
// This should always be called last to ensure that
// middleware is registered in the correct order.
app.UseMvc();
}
根据Henk的回答，我已经能够提出特定的域，我想允许的方法，以及我想启用CORS的头:
public void ConfigureServices(IServiceCollection services)
{
services.AddCors(options =>
options.AddPolicy("AllowSpecific", p => p.WithOrigins("http://localhost:1233")
.WithMethods("GET")
.WithHeaders("name")));
services.AddMvc();
}
用法:
[EnableCors("AllowSpecific")]
适用于。net Core 1和。net Core 2
如果使用.Net-Core 1.1
不幸的是，在这个特定的情况下，文件非常混乱。所以我要让它变得非常简单:
将Microsoft.AspNetCore.Cors nuget包添加到项目中 在ConfigureServices方法中添加services.AddCors(); 在Configure方法中，在调用app.UseMvc()和app.UseStaticFiles()之前，添加: app.UseCors(生成器=>生成器 .AllowAnyOrigin () .AllowAnyMethod () .AllowAnyHeader () .AllowCredentials ());
就是这样。每个客户端都可以访问您的ASP。NET核心网站/API。
如果使用。net - core 2.0
Add Microsoft.AspNetCore.Cors nuget package to your project in ConfigureServices method, before calling services.AddMvc(), add: services.AddCors(options => { options.AddPolicy("AllowAll", builder => { builder .AllowAnyOrigin() .AllowAnyMethod() .AllowAnyHeader() .AllowCredentials(); }); }); (Important) In Configure method, before calling app.UseMvc(), add app.UseCors("AllowAll"); "AllowAll" is the policy name which we need to mention in app.UseCors. It could be any name.
