Access to XMLHttpRequest at 'https://api.example.com' from origin 'https://app.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
ID: dotnet/aspnet-cors-blocked
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| 8 | active | — | — | — |
Root Cause
CORS policy blocked errors occur when the ASP.NET Core server does not include the required Access-Control-Allow-Origin header. Common causes include missing CORS middleware, incorrect origin configuration, or middleware order issues where CORS runs after authentication rejects the preflight request. Fix by properly configuring CORS policy and middleware order.
genericWorkarounds
-
92% success Configure CORS policy with specific allowed origins
In Program.cs: builder.Services.AddCors(options => { options.AddPolicy("AllowFrontend", policy => policy.WithOrigins("https://app.example.com").AllowAnyMethod().AllowAnyHeader().AllowCredentials()); }); Then add middleware in the correct order: app.UseRouting(); app.UseCors("AllowFrontend"); app.UseAuthentication(); app.UseAuthorization(); -
88% success Ensure UseCors middleware is placed before UseAuthentication
CORS preflight (OPTIONS) requests must be handled before authentication middleware rejects them with 401. Place app.UseCors() after app.UseRouting() but before app.UseAuthentication(). This allows the CORS middleware to respond to preflight requests without requiring authentication
Dead Ends
Common approaches that don't work:
-
Adding CORS headers manually in a custom middleware or action filter
70% fail
Bypasses the built-in CORS middleware's preflight handling; OPTIONS requests are not properly handled, and the custom headers may conflict with or be overridden by other middleware. Also misses edge cases like credentials, exposed headers, and max-age
-
Using AllowAnyOrigin() combined with AllowCredentials()
95% fail
The CORS specification explicitly forbids wildcard origins with credentials. ASP.NET Core will throw an InvalidOperationException: 'The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time'