ASP.NET Core Web API Interview Question #69

What is CORS in ASP.NET Core Web API?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

CORS, or Cross-Origin Resource Sharing, is a browser security mechanism that controls whether frontend code from one origin may access resources from another origin. The API declares allowed origins, methods, headers, and credential behavior through CORS response headers.

Detailed Explanation

CORS is not authentication or authorization. Non-browser clients are not prevented from calling an API merely because a CORS policy rejects a browser origin.

Code Example

builder.Services.AddCors(options =>
{
    options.AddPolicy("Frontend", policy =>
        policy.WithOrigins("https://app.example.com")
              .AllowAnyHeader()
              .AllowAnyMethod());
});

app.UseCors("Frontend");