title: Path was not for an allowed IdentityServer CORS endpoint from Blazor, but works in Postman
body: <p>Have an Identity user database API with IdentityServer4 and a Blazor client in separate projects. I'm able to register a new user via Postman.
  When running the code below in the Blazor client (for tinkering and learning) </p>
  
  <pre><code>@page "/registrer"
  @using Models
  @using System.Net.Http
  @using IdentityModel.Client
  @inject HttpClient Http
  
      &lt;EditForm Model="@registerUserModel" OnValidSubmit="@HandleValidSubmit"&gt;
          &lt;DataAnnotationsValidator /&gt;
          &lt;ValidationSummary /&gt;
  
          &lt;InputText id="email" type="email" @bind-Value="@registerUserModel.Email" /&gt;
          &lt;InputText id="password" type="password" @bind-Value="@registerUserModel.Password" /&gt;
          &lt;InputText id="confirmPassword" type="password" @bind-Value="@registerUserModel.ConfirmPassword" /&gt;
  
          &lt;button type="submit"&gt;Registrer deg&lt;/button&gt;
      &lt;/EditForm&gt;
  
  @code {
      private RegisterUserModel registerUserModel = new RegisterUserModel();
  
      public async Task HandleValidSubmit()
      {
          var newUser = new RegisterUserModel
          {
              Email = registerUserModel.Email,
              Password = registerUserModel.Password,
              ConfirmPassword = registerUserModel.ConfirmPassword
          };
  
          var client = new HttpClient();
  
          var response = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
          {
              Address = "https://localhost:5001/connect/token",
  
              ClientId = "client",
              ClientSecret = "511536EF-F270-4058-80CA-1C89C192F69A",
              Scope = "api1"
          });
  
          Http.SetBearerToken(response.AccessToken);
  
          await Http.PostJsonAsync("https://localhost:5001/register", newUser);
      }
  }
  </code></pre>
  
  <p>I am able to get the access token and validate the Blazor client, but then I get this error</p>
  
  <blockquote>
    <p>dbug: IdentityServer4.Hosting.CorsPolicyProvider[0]
          CORS request made for path: /register from origin: <a href="http://localhost:60013" rel="nofollow noreferrer">http://localhost:60013</a> but was ignored because path was not for an
    allowed IdentityServer CORS endpoint</p>
  </blockquote>
  
  <p>Why? When it works in Postman and there is no CORS policy. Have tried to allow the client with <code>AllowedCorsOrigins</code>, just to check.</p>
  
  <h2>Answer</h2>
  
  <p>Browser security prevents a webpage from making requests to a different domain than the one that served the webpage. This restriction is called the same-origin policy. The same-origin policy prevents a malicious site from reading sensitive data from another site. To make requests from the browser to an endpoint with a different origin, the endpoint must enable cross-origin resource sharing (CORS).</p>
  
  <p>And it's not a good idea to store client secrets in an SPA or mobile app as every user is able to see and manipulate all code. </p>