Cross-Origin Requests (CORS) in ASP.NET Core | Getting Started With ASP.NET Core Series

Hello friends, Browser security prevents a web page from making requests to a different domain than the one that served the web page. This restriction is called the same-origin policy. The same-origin policy prevents a malicious site from reading sensitive data from another site.

Sometimes, you might want to allow other sites to make cross-origin requests to your application. This is usually when you have an API hosted independently and your different web applications talking to the API. In such scenarios, we need to enable CORS support on the API, so that the web application can call it.

In this video, let's learn about CORS, how it works, how to enable it in ASP NET API. I will show to how to simulate a CORS error in ASP NET Single Page Application and then add the appropriate configuration to ease the browser policies using CORS.

CORS is not a security feature, It is a W3C standard to relax same-origin policy. However if configured incorrectly CORS can cause potential issues to your application. Make sure to be explicit about the origins that can interact with the API that you are building.

Additional Watching

Come say hi! ✋

Video Edited by my wife, Parvathy 😍

Make sure to SUBSCRIBE to the channel. THANK YOU for helping me grow this channel !!

[RahulNath]

My lovely wife, Parvathy decided to help me with the video editing this time. Sound off in the comments if you have any feedback.

[aikidoshi]

That is a brilliant summary of CORS, very clear and straight to the point. Good job.

[vidittyagi]

one of the finest content I have come across. I have subscribed your channel. Thank you so much.

[DjHomerr]

Absolutely love this series, as well as this video! Finally someone explaining cors in details and also addressing the misconception when people say that it is a security feature. Hope to see more videos on .NET 8 and the new things that come with it!

[bhavyashah]

I have been using cors in my asp.net core application to fetch requests from Angular.

Nice explanation! Today, I got to know more about cors.

[radhagobindamishra]

I had watched many videos and tutorials but still I was never able to understand the CORS concept until I watched this video.
Thanks a lot Rahul.

[parveensharma]

Great learning experience with you. Thanks for this to the point video.

[anuragnair]

Your videos have been a great source of learing and have helped me a lot in my professional career.
Wanted to thank you all the efforts you take and the knowledge you share.

[androidsavior]

you are so brilliant, this is the best video ever for CORS

[starman]

Hey Rahul, Nice content again! recently i have moved to Salesforce, but i keep coming to see .net content to your vlog! great work again, Besafe.

[dhivyadharshini]

Such a clean content! Impressed sir! Subscribed!

[anurag]

very well explained. Cheers. I learnt the pre-flight call.

[enriquecs]

thanks for the information dude, it was really helpful!

[naylenjohanarodriguez]

your content is just priceless. thanks and keep going

[rohithajare]

Hi Rahul, You are simply awesome man. I appreciate your efforts and passion for the technology

[raagasongs]

Thanks Rahul..It helps me better understanding of CORS Policy.

[TridentEnjoyer]

I really appreciate the tutorials it helped me a lot in my problems.

[reinhardheydrich]

thank you so much, you are a life saver ty

[LatinoTropico]

Excellent video Rahul. Thank you. I am new to CORS and like most thought it was necessary in my API for security reasons. Question: do I need to use CORS as a security feature if a hacker finds a way to access my API from a different domain? If I do not use CORS at all in my API, will the standard HTTPS security be enough to stop such a hack? In my case, my API is only accessible from one domain and no other domains have access to that domain, due to other internal system security measures. So I should be ok not to use CORS?

[gouthamk]

Hey Rahul! The way you explain is really awesome and thanks! So I was using devops as just a code repository before, but know we are integrating pipeline and release! Could you please do a video on getting connecting strings and app settings from web app service for a asp.net core web api! Do we have to change code to do so or will changing the configuration in azure portal will work! Thanks again, keep going!