title: Cors Policy problem Blazor WASM, Web API and Identity Server 4 and IIS
body: <p>I got Cors policy error when trying to do POST request to the web api from my WASM blazor app.</p>
  <blockquote>
  <p>Access to fetch at 'http://localhost:8080/DashboardService/TestConnection' from origin 'https://localhost:8081' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  </blockquote>
  <p>I have no problem in debug mode, only with IIS publish</p>
  <p>Startup.cs (WEB API)</p>
  <pre><code>   public class Startup
  {
      #region Fields/Attributes
  
      private static readonly NLog.Logger logger = NLog.LogManager.GetCurrentClassLogger();
  
      private readonly IConfiguration configuration;
  
      #endregion Fields/Attributes
  
      #region Constructors
  
      /// &lt;summary&gt;
      /// Initializes a new instance of the &lt;see cref=&quot;Startup&quot;/&gt; class.
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;configuration&quot;&gt;The configuration identifier&lt;/param&gt;
      public Startup(IConfiguration configuration)
      {
          logger.Trace($&quot;{GetType().FullName} constructed&quot;);
          this.configuration = configuration;
      }
  
      #endregion Constructors
  
      #region Methods
  
      /// &lt;summary&gt;
      /// This method gets called by the runtime. Use this method to add services to the container.
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;services&quot;&gt;The service collection identifier&lt;/param&gt;
      public void ConfigureServices(IServiceCollection services)
      {
         
  
          // Statistics And Monitoring Service
          services.AddSingleton&lt;IDashboardService, DashboardService&gt;();
          services.AddSingleton&lt;IManualLogsService, ManualLogsService&gt;();
  
          services.AddCors(options =&gt;
          {
              options.AddPolicy(&quot;CorsPolicy&quot;,
                builder =&gt;
                {
                    builder
                    .AllowAnyOrigin()
                    .AllowAnyHeader()
                    .AllowAnyMethod();
                });
          });
  
          services.AddCors(options =&gt; options.AddPolicy(&quot;CorsPolicy2&quot;,
          builder =&gt;
          {
              builder.WithOrigins(&quot;https://localhost:8081&quot;).AllowAnyHeader()
                     .AllowAnyMethod()
                     .AllowCredentials();
          }));
  
          services.AddSignalR(options =&gt;
          {
              options.EnableDetailedErrors = true;
              options.MaximumReceiveMessageSize = long.MaxValue;
              options.ClientTimeoutInterval = TimeSpan.FromSeconds(240);
              options.KeepAliveInterval = TimeSpan.FromSeconds(120);
          })
        
  
          string identityServerAuthority =  &quot;https://localhost:8082&quot;;
  
  
          services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
              .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, opt =&gt;
              {
                  opt.RequireHttpsMetadata = false;
                  opt.Authority = identityServerAuthority;
                  opt.Audience = &quot;backend&quot;; 
              });
  
       
          logger.Trace($&quot;Services configured&quot;);
      }
  
      /// &lt;summary&gt;
      /// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;app&quot;&gt;The application builder identifier&lt;/param&gt;
      /// &lt;param name=&quot;env&quot;&gt;The web host environement identifier&lt;/param&gt;
      /// &lt;param name=&quot;agentsService&quot;&gt;The AgentsService identifier&lt;/param&gt;
      /// &lt;param name=&quot;collectedValueConverter&quot;&gt;The CollectedValueConverter identifier&lt;/param&gt;
      /// &lt;param name=&quot;databaseConnectionService&quot;&gt;The DatabaseConnectionService identifier&lt;/param&gt;
      [System.Diagnostics.CodeAnalysis.SuppressMessage(&quot;Style&quot;, &quot;IDE0060:Remove unused parameter&quot;, Justification = &quot;Dependency injecting only to force instantiation of Singletons&quot;)]
      public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IDataBaseServiceApplicationConfig dataBaseServiceApplicationConfig, IAgentsService agentsService, IMachineStructureService machineStructureService, ICollectedValueConverter collectedValueConverter, IDatabaseConnectionService databaseConnectionService)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
          else
          {
              //app.UseHsts();
          }
          //app.UseHttpsRedirection();
  
          app.UseRouting();
  
          app.UseCors(&quot;CorsPolicy2&quot;);
          app.UseAuthentication();
  
          app.UseAuthorization();
  
          app.UseStaticFiles();
  
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapControllers(); 
              endpoints.MapHub&lt;BackEndHub&gt;(&quot;/DashboardService&quot;);
          });
      }
  
      #endregion Methods
  }
  </code></pre>
  <p>I got [Authorize] attributes on my controller, if I remove them it's working...</p>
  <p>Could anyone help me with that ? Thanks in advance</p>
  <p>Rihen</p>