title: How to get rid of CORS in .net core 2.2?
body: <p>I've updated my project to .net core 2.2 and it seems like CORS is making problems that weren't there in 2.1.</p>
  
  <p>I'm running my app on this URL: <code>http://*:5300</code></p>
  
  <p>I've added this code in the <code>Startup.cs</code>:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      ...
  
      services.AddCors(options =&gt;
                       options.AddPolicy("MyPolicy", builder =&gt;
                       {
                           builder.AllowAnyOrigin()
                                  .AllowAnyMethod()
                                  .AllowCredentials()
                                  .AllowAnyHeader();
                       }));
  
      services.AddMvc();
  
      ...
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      ...
  
      app.UseCors(builder =&gt;
      {
          builder.AllowAnyOrigin()
                 .AllowAnyMethod()
                 .AllowCredentials()
                 .AllowAnyHeader();
      });
  
      app.UseAuthentication();
      app.UseMvc();
  }
  </code></pre>
  
  <p>This didn't work, so I've added on top of it the <code>[EnableCors]</code> attribute on my `BaseController" class:</p>
  
  <pre><code>[EnableCors]
  [Authorize]
  [Produces("application/json")]
  [Route("api/[controller]")]
  public class BaseController : Controller
  {
  
  }
  </code></pre>
  
  <p>But I'm still getting this CORS error:</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://192.168.15.63:5301/api/permissions/UI" rel="nofollow noreferrer">http://192.168.15.63:5301/api/permissions/UI</a>' from origin '<a href="http://192.168.15.63:5302" rel="nofollow noreferrer">http://192.168.15.63:5302</a>' has been blocked by CORS policy:<br>
    Response to preflight request doesn't pass access control check:<br>
    The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.<br>
    The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>What else can I do in order to completely remove CORS?</p>