title: I'm getting CORS error with CORS configured on ASP.NET Core Web API app
body: <p>I have an ASP.NET Core Web API hosted in Azure. When I'm trying to make a fetch request from my web app hosted on Vercell, I'm getting this error:</p>
  <blockquote>
  <p>Access to fetch at <code>{myapi enpoint}</code> from origin 'https://<code>{myapp}</code>.vercel.app' has been blocked by CORS policy:<br />
  Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  </blockquote>
  <p>This is my <code>Startup.cs</code> file:</p>
  <pre><code>using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.AspNetCore.HttpsPolicy;
  using Microsoft.AspNetCore.Mvc;
  using Microsoft.AspNetCore.Cors;
  using Microsoft.Extensions.Configuration;
  using Microsoft.Extensions.DependencyInjection;
  using Microsoft.Extensions.Hosting;
  using Microsoft.Extensions.Logging;
  using Microsoft.OpenApi.Models;
  using System;
  using System.Collections.Generic;
  using System.Linq;
  using Pomelo.EntityFrameworkCore.MySql;
  using System.Threading.Tasks;
  using ctsapi.Services;
  using Jose;
  using Microsoft.AspNetCore.Authentication.JwtBearer;
  using Microsoft.IdentityModel.Tokens;
  using System.Text;
  using ctsapi.Models;
  using Newtonsoft.Json.Linq;
  using Microsoft.AspNetCore.Http;
  using System.Net;
   
  namespace ctsapi
  {
      public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
   
          public IConfiguration Configuration { get; }
   
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddCors(options =&gt;
              {
                  options.AddPolicy(&quot;AllowAllOrigins&quot;, builder =&gt;
                  {
                      builder.AllowAnyOrigin();
                      builder.AllowAnyMethod();
                      builder.AllowAnyHeader();
                  });
              });
              services.AddControllers();
              services.AddSwaggerGen(c =&gt;
              {
                  c.SwaggerDoc(&quot;v1&quot;, new OpenApiInfo { Title = &quot;ctsapi&quot;, Version = &quot;v1&quot; });
                  //c.IncludeXmlComments(XmlCommentsPath.XmlCommentsFilePath);
              });
   
              var jwtSection = Configuration.GetSection(&quot;JWTSettings&quot;);
              services.Configure&lt;JWTSettings&gt;(jwtSection);
   
              //to validate the token which has been sent by clients
              var appSettings = jwtSection.Get&lt;JWTSettings&gt;();
              var key = Encoding.ASCII.GetBytes(appSettings.SecretKey);
   
              services.AddAuthentication(x =&gt;
              {
                  x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
                  .AddJwtBearer(x =&gt;
                  {
                      x.RequireHttpsMetadata = true;
                      x.SaveToken = true;
                      x.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                      {
                          ValidateIssuerSigningKey = true,
                          IssuerSigningKey = new SymmetricSecurityKey(key),
                          ValidateIssuer = false,
                          ValidateAudience = false
                      };
                  });
   
              services.AddAuthorization(options =&gt;
              {
                  options.AddPolicy(Policies.Admin, Policies.AdminPolicy());
                  options.AddPolicy(Policies.ShopKeeper, Policies.ShopKeeperPolicy());
                  options.AddPolicy(Policies.User, Policies.UserPolicy());
              });
          }
   
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              app.UseDefaultFiles();
              app.UseStaticFiles(); // dodanie wwwroot
              //if (env.IsDevelopment())
              //{
                  app.UseDeveloperExceptionPage();
                  app.UseSwagger();
                  app.UseSwaggerUI(c =&gt; c.SwaggerEndpoint(&quot;/swagger/v1/swagger.json&quot;, &quot;ctsapi v1&quot;));
              //}
   
              app.UseHttpsRedirection();
   
              app.UseRouting();
   
              app.Use(async (context, next) =&gt;
              {
                  await next();
   
                  if (context.Response.StatusCode == (int)HttpStatusCode.Unauthorized)
                  {
                      // &quot;Token Validation Has Failed. Request Access Denied&quot;
                      context.Response.ContentType = &quot;application/json&quot;;
                      await context.Response.WriteAsync(new ErrorDto()
                      {
                          StatusCode = 401,
                          Message = &quot;Token Validation Has Failed. Request Access Denied&quot;
                      }.ToString());
                  }
              });
   
              app.UseCors(&quot;AllowAllOrigins&quot;);
   
              app.UseAuthorization();
   
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllers();
              });
          }
      }
  }
  </code></pre>
  <p>Any idea why this is happening?</p>
  <p>My web app framework is Next.js.</p>
  <p>This is my Azure configuration:</p>
  <ul>
  <li>Default deploy profile (WebApp hosted on Windows machine with F1 tier)</li>
  <li>I even changed the <code>web.config</code> file to always send required headers</li>
  </ul>