title: How do I expose a C# Web API method to any calling origin?
body: <p>I have a C# Web API with this method (in its entirety):</p>
  <pre><code>public JsonResult PlanItems(string sessionId)
  {
      Response.Headers.Add(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
      DTDBDataService svc = new DTDBDataService(_db);
      VM.PlanItems = svc.GetPlanItems(VM.User);
  
      return Json(VM.PlanItems);
  }
  </code></pre>
  <p>I have a decoupled Angular client that makes this call to the api:</p>
  <pre><code>this.http.get&lt;[DTPlanItem]&gt;(url).subscribe( data =&gt; {
      console.log(&quot;Plan items: &quot;, data); 
  
      for (let i = 0; i &lt; data.length; i++)
      {
          console.log(data[i]);
          this.planItems.push(data[i]);
      }
  
      console.log(&quot;Loaded items: &quot;, this.planItems);
  });
  </code></pre>
  <p>When running in dev (localhost), the client calling from <code>http://localhost:4200</code> uses this url:</p>
  <pre><code>https://localhost:44324/Planner/PlanItems?sessionId=e829fb5c-aa6d-43c9-99e7-0552afd8bc7e.
  </code></pre>
  <p>When the Web API is deployed, the client (still calling from <code>http://localhost:4200</code>) use this url:</p>
  <pre><code>https://7822-54268.el-alt.com/Planner/PlanItems?sessionId=8d240409-09ba-4d9d-914a-7c0031fd8a6b.
  </code></pre>
  <p>The deployed API results in an error:</p>
  <blockquote>
  <p>Access to XMLHttpRequest at 'https://7822-54268.el-alt.com/Planner/PlanItems?sessionId=4207b27d-7f65-4289-beb5-8ae35c7c5da3' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  </blockquote>
  <p>It can't be unusual to deploy a Web API with the expectation that the clients will be calling from any, unknown domain. How do I expose a C# Web API method to any calling origin? This can't be an unusual situation. There are an uncountable number of Web APIs that are allowable from a cross origin. How is it done?</p>