title: ASP.NET Core Disable CORS for specific controllers
body: <p>I have different set of controllers in my application (let's say A and B). CORS for A controller needs to be enabled and disabled for B controllers.
  I have configured CORS via the policies in the following way:</p>
  
  <p>ConfigureServices method:</p>
  
  <pre><code>services.AddCors(
      options =&gt;
      {
          options.AddPolicy(
              "AllowCors",
              builder =&gt;
                  {
                      builder.AllowAnyOrigin().WithMethods(
                          HttpMethod.Get.Method,
                          HttpMethod.Put.Method,
                          HttpMethod.Post.Method,
                          HttpMethod.Delete.Method).AllowAnyHeader().WithExposedHeaders("CustomHeader");
                  });
      });
  services.AddMvcCore()
  </code></pre>
  
  <p>Configure method</p>
  
  <pre><code>app.UseCors("AllowCors");
  app.UseMvc();
  </code></pre>
  
  <p>Set of A controllers has EnableCors attribute </p>
  
  <pre><code>[EnableCors("AllowCors")]
  public class ControllerA1: Controller
  </code></pre>
  
  <p>CORS works for set of A controller as expected (tested via the browser). However, it also does work for B controllers! I even tried to disable CORS with DisableCors attribute explicitly:</p>
  
  <pre><code>[DisableCors]
  public class ControllerB1: Controller
  </code></pre>
  
  <p>However, ControllerB1 controller can be requested from UI anyway.</p>
  
  <p>Headers in browser for B1 contoller</p>
  
  <p>Request</p>
  
  <pre><code>Provisional headers are shown
  Origin: http://localhost:5000
  Referer: http://localhost:5000/all
  User-Agent: Mozilla/5.0 AppleWebKit Chrome/69 Safari/537
  </code></pre>
  
  <p>Response </p>
  
  <pre><code>Request URL: http://XX.XX.XX.XX/getall
  Request Method: GET
  Status Code: 200 OK
  Remote Address: XX.XX.XX.XX:80
  Referrer Policy: no-referrer-when-downgrade
  Access-Control-Allow-Origin: *
  Access-Control-Expose-Headers: CustomCount        
  Content-Type: application/xml; charset=utf-8
  Server: Kestrel
  </code></pre>
  
  <p>Could you please advise how to disable CORS for specific controllers?</p>