Mastering CORS in .NET: 10 Expert Tips for Secure API Configuration

Get practical tips and expert advice on CORS implementation in .NET with our developer’s guide.

Introduction

Cross-Origin Resource Sharing (CORS) is a process that protects your APIs from defined domains, method types, or headers, and the properties are defined while adding the CORS policy.

Getting Started

Please find below 10 tips to configure CORS in .NET applications.

1. Understand CORS Basics

To set up the handshake between the UI and the API layer, a basic understanding of how CORS headers are required, such as

• Access-Control-Allow-Origin
• Access-Control-Allow-Methods
• Access-Control-Allow-Headers

Example: The CORS headers define which domains can access your APIs.

    access-control-allow-origin: https://example.com

2. Configure CORS in Startup.cs

You can configure CORS in Program.cs by using CORS middleware, as shown below.

Example

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy("AllowSpecificOrigin",
                builder =>
                {
                    builder.WithOrigins("https://example.com")
                           .AllowAnyMethod()
                           .AllowAnyHeader();
                });
        });
        
        services.AddControllers();
    }
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseRouting();
        app.UseCors("AllowSpecificOrigin"); // Apply the CORS policy
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }

3. Use WithOrigins to Restrict Access

To specify the array of domains that are allowed to access the APIs that validate any unauthorized domain request to your API server.

Use WithOrigins method to specify the list of domains comma-separated, as shown below.

Example

    builder.WithOrigins("https://example1.com", "https://example2.com")
           .AllowAnyMethod()
           .AllowAnyHeader();

4. Allow Specific HTTP Methods

One can also allow only specific REST methods using WithMethods, which helps filter out which type of API methods are allowed.

Example

    builder.WithOrigins("https://example.com")
           .WithMethods("GET", "POST") // Allow only GET and POST methods
           .AllowAnyHeader();

5. Limit Allowed Headers

A developer can also restrict headers when using WithHeaders.

Example

    builder.WithOrigins("https://example.com")
           .AllowAnyMethod()
           .WithHeaders("Content-Type", "Authorization");

6. Enable Credentials if Necessary

Use AllowCredentials() only if your application supports credentials via Cookie Authentication.

Example

    builder.WithOrigins("https://example.com")
           .AllowAnyMethod()
           .AllowAnyHeader()
           .AllowCredentials(); // Allows credentials

7. Use CORS with MVC or Web API Controllers

The CORS policy can be applied globally, i.e., on the application level as well as at the controller/action level.

Example

    [EnableCors("AllowSpecificOrigin")]
    public class MyController : ControllerBase
    {
        // Controller actions
    }

8. Handle Preflight Requests

Preflight requests are sent by the browser to check permissions before making the actual requests. Ensure that the CORS policy is properly configured and allows OPTIONS requests.

Example: ASP.NET Core automatically handles preflight requests if CORS is properly configured.

9. Use Environment-Specific CORS Policies

CORS policy can be applied conditionally based on the environment, which provides flexibility to implement different policies as per the environment, such as DEV, QA, or Production

Example

    if (env.IsDevelopment())
    {
        builder.WithOrigins("http://localhost:3000") // Development origin
               .AllowAnyMethod()
               .AllowAnyHeader();
    }
    else
    {
        builder.WithOrigins("https://production.com") // Production origin
               .AllowAnyMethod()
               .AllowAnyHeader();
    }

10. Regularly Review and Update CORS Policies

CORS policy needs to be updated as per your newer application requirements. Let’s say a newer application is supposed to connect to CORS-implemented REST API, then you need to configure the domain, method or header as per the new application requirements.

Monitor your application’s request patterns and adjust CORS settings as needed to maintain security and functionality.

Conclusion

By following these tips, developers can effectively implement and manage CORS in your .NET applications, ensuring secure and controlled access to API resources from multiple origins.

C# Programming🚀

Thank you for being a part of the C# community!