I have an API developed internally to pull data out of a SQL Server database. One thing I've noticed is that it's using CORS and I don't know how it got here to be honest.

Why would I need to do this? What benefit, when the API works as is.

Program.cs

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

//do I really need this!?!
builder.Services.AddCors(p => p.AddPolicy("corsapp", builder =>
{
    builder.WithOrigins("*").AllowAnyMethod().AllowAnyHeader();
}));

var startup = new Startup(builder.Configuration);
startup.ConfigureServices(builder.Services);

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

startup.Configure(app);

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

//why!?!
app.UseCors("corsapp");

app.UseAuthorization();

app.MapControllers();

app.Run();

CodePudding user response：

You would need to know if your program provides API responses to client applications loaded from other domains to determine if you need to enable CROS.

For example, there are two cases where no action is needed for CORS support:

1. Swagger UI is hosted on the same server as the application itself (same host and port).
2. The application is located behind a proxy that enables the required CORS headers. This may already be covered within your organization.

You can get a better understanding and use of CROS through this link and this official documentation.

Hope this can help you.