ASP.NET Core Web API Interview Question #70

Why should AllowAnyOrigin be used carefully?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

AllowAnyOrigin permits browser JavaScript from any origin to make permitted cross-origin requests to the API. That may be appropriate for intentionally public APIs, but it is usually too broad for private browser applications.

Detailed Explanation

AllowAnyOrigin permits browser JavaScript from any origin to make permitted cross-origin requests to the API. That may be appropriate for intentionally public APIs, but it is usually too broad for private browser applications.

Credentialed CORS has additional restrictions: wildcard origins cannot simply be combined with AllowCredentials. Configure explicit trusted origins when browser credentials or sensitive data are involved.

Code Example

policy.WithOrigins(
        "https://app.example.com",
        "https://admin.example.com")
      .AllowAnyHeader()
      .AllowAnyMethod();