title: Access-Control-Allow-Origin Problem in .NET Core Deployed at IIS Configured on Windows Server 2016
body: <p>I have gone through several documentations at <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1" rel="nofollow noreferrer">Enable Cross-Origin Requests</a> and <a href="https://stackoverflow.com/questions/31942037/how-to-enable-cors-in-asp-net-core">SO Answers</a> here but I'm still not getting it right. Also followed <a href="https://www.iis.net/downloads/microsoft/iis-cors-module" rel="nofollow noreferrer">Installed IIS CORS module</a></p>
  
  <p>I have a .net core api 3.1 running on IIS at AWS EC2 Windows Server 2016 datacenter, with endpoint like <a href="https://6.13.21.111/api/user/authenticate" rel="nofollow noreferrer">https://6.13.21.111/api/user/authenticate</a>. I have an angular 8 front end app running on AWS Amplify url like <a href="https://tests.d1nkxxfifp945dd.myapp.com" rel="nofollow noreferrer">https://tests.d1nkxxfifp945dd.myapp.com</a> Any time I make a request to the API I get the error below. </p>
  
  <p>Access to XMLHttpRequest at '<a href="https://6.13.21.111/api/user/authenticate" rel="nofollow noreferrer">https://6.13.21.111/api/user/authenticate</a>' from origin '<a href="https://tests.d1nkxxfifp945dd.myapp.com" rel="nofollow noreferrer">https://tests.d1nkxxfifp945dd.myapp.com</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  zone.js:3372 POST <a href="https://6.13.21.111/api/users/authenticate" rel="nofollow noreferrer">https://6.13.21.111/api/users/authenticate</a> net::ERR_FAILED</p>
  
  <p>Also getting the same issue when I send request to endpoint from <a href="http://localhost:4200/" rel="nofollow noreferrer">http://localhost:4200/</a>
  I have setup the following </p>
  
  <p>Startup.cs</p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
  
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddCors(options =&gt;
          {
              options.AddPolicy(name: MyAllowSpecificOrigins,
                      builder =&gt;
                      {
                          builder.AllowAnyOrigin()
                              .AllowAnyHeader()
                              .AllowAnyMethod();
                      });
          });
  
          services.AddControllers();
          services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_3_0);
      }
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          app.UseHttpsRedirection();
          app.UseStaticFiles();
          app.UseRouting();
          app.UseCors(MyAllowSpecificOrigins);
          app.UseAuthentication();
  
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapControllers();
          });
      }
  }
  </code></pre>
  
  <p>User Controller </p>
  
  <pre><code>[Route("api/[controller]")]
  [EnableCors("MyAllowSpecificOrigins")]
  [ApiController]
  public class UsersController : ControllerBase
  {
  
      private IUserService _userService;
  
      public UsersController(IUserService userService)
      {
          _userService = userService;
  
      }
  
      [HttpPost("authenticate")]
      public Task&lt;ApiResponse&gt; Authenticate([FromBody]UserRequest userRequest)
      {
          return _userService.Authenticate(userRequest);
      }
  
  }
  </code></pre>