title: Request always has been blocked by CORS policy c# net core
body: <p>Hi i have trouble with cors error i read the all examples from stack and other website but any dont helped me.
  I have the rest api written in net core 2.1 and the client app( i use react framework) and i try to fetch api from rest api, all was on the localhost.
  Server on <a href="http://localhost:44334" rel="nofollow noreferrer">http://localhost:44334</a> and react client on <a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>
  When i try to fetch api on the server i get this exception: </p>
  
  <blockquote>
    <p>Microsoft.AspNetCore.Cors.Infrastructure.CorsService:Information: Policy execution failed.
    Microsoft.AspNetCore.Cors.Infrastructure.CorsService:Information: Request header 'access-control-allow-origin' not allowed in CORS policy.
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request finished in 3.9493ms 204 </p>
  </blockquote>
  
  <p>But on the react client on browser i get this: </p>
  
  <blockquote>
    <p>Access to fetch at '<a href="https://localhost:44334/Account" rel="nofollow noreferrer">https://localhost:44334/Account</a>' from origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  </blockquote>
  
  <p>This is my c# class when i register cors, i remember to register instance behind .AddMvc method</p>
  
  <pre><code> public IServiceProvider ConfigureServices(IServiceCollection services)
      {
          services.AddAuthorization(options =&gt;
          {
              options.AddPolicy("RequireAdministratorRole", policy =&gt; policy.RequireRole("Administrator"));
          });
  
  
          services.AddCors();
  
  
          services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
  
          services.AddOptions();
          services.AddMemoryCache();
  
          var jwt_settings = Configuration.GetSettings&lt;JwtSettings&gt;();
  
          services.AddAuthentication(o =&gt;
              {
                  o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
              .AddJwtBearer(cfg =&gt;
              {
                  cfg.TokenValidationParameters = new TokenValidationParameters
                  {
                      IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt_settings.Key)),
                      ValidIssuer = jwt_settings.Issuer,
                      ValidateIssuer = false,
                      ValidateAudience = false,
                      ValidateIssuerSigningKey = true,
                      ValidateLifetime = true
                  };
              });
          var builder = new ContainerBuilder();
          //register commandModules 
          builder.Populate(services);
          builder.RegisterModule(new ContainerModules(Configuration));
          ApplicationContainer = builder.Build();
  
          return new AutofacServiceProvider(ApplicationContainer);
      }
  </code></pre>
  
  <p>And register on Configure method:</p>
  
  <pre><code> app.UseCors(
              options =&gt; options.WithOrigins("http://localhost:3000").AllowAnyMethod()
          );
  
          app.UseMvc();
  </code></pre>
  
  <p>And this i paste the react code where i fetch api:</p>
  
  <pre><code>export function login(password, email) {
  fetch("https://localhost:44334/Account", {
      method: "POST", // *GET, POST, PUT, DELETE, etc.
      mode: "cors", // no-cors, cors, *same-origin
      cache: "no-cache", // *default, no-cache, reload, force-cache, only-if-cached
      credentials: "same-origin", // include, *same-origin, omit
      headers: {
          "Content-Type": "application/json",
          // "Content-Type": "application/x-www-form-urlencoded",
          'Accept': 'application/json',
          "Access-Control-Allow-Origin": "*"
      },
      body: {email, password}
  }).then(res =&gt; res.json())
      .then(response =&gt; console.log('Success:', response))
      .catch(error =&gt; console.error('Error:', error));
  </code></pre>
  
  <p>}</p>
  
  <p>And the controller method on this i dont use EnableCors:</p>
  
  <pre><code>[HttpPost]
      public async Task&lt;IActionResult&gt; Login([FromBody] LoginAsync login)
      {
          login.TokenId = Guid.NewGuid();
          await _commandDispatcher.DispatchAsync(login);
          var jwt = _memoryCache.Get&lt;JsonWebToken&gt;(login.TokenId);
          return Json(jwt);
      }
  </code></pre>