title: Chrome throws CORS error when calling https from http, and ASP Core does not send CORS header
body: <p>Is request considered a CORS even if it is between addresses in the same domain but with a different protocol?</p>
  
  <p>Because I get code 401 in console:</p>
  
  <pre><code>XMLHttpRequest cannot load 
  https://xxx.yyy.com/appname/css/left-pane-menu.component.min.css. 
  No 'Access-Control-Allow-Origin' header is present on the requested resource. 
  Origin 'http://xxx.yyy.com' is therefore not allowed access. 
  The response had HTTP status code 401.
  </code></pre>
  
  <p>On one hand, the asp core will not send cors headers for the same origin, on the other Chrome will not accept request from other protocol. Wow.</p>
  
  <p>What are my options besides calling resources from the same protocol.
  I can't do that. I need to call https always due to some Azure Enterprise proxy setting that mislead my site into thinking it is called with http when it was called with https thus the base url tag in html was set to <a href="http://xxx.yyy.com/myapp" rel="nofollow noreferrer">http://xxx.yyy.com/myapp</a> and Chrome would throw that it cannot access insecure resources from secure connection.</p>
  
  <p>My Startup.cs looks like this:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
        services.AddCors(); 
        services.AddMvc()
                .AddJsonOptions(x =&gt;
                {
                      x.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
                  });
  }
  
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
              app.UseCors(c=&gt;
                  c
                  .AllowAnyOrigin()
                  .AllowAnyMethod()
                  .AllowAnyHeader()
                  .AllowCredentials()
              );
  
          app.UseResponseCompression();
  
          app.UseStaticFiles(new StaticFileOptions());
  
          app.UseMvc(routes =&gt;
          {
              routes.MapRoute(
                  name: "default",
                  template: "{controller=Home}/{action=Index}/{id?}");
              routes.MapSpaFallbackRoute("spa-fallback", new { controller = "Home", action = "Index" });
          });
  }
  </code></pre>