Aspnetcore.docs: What is the purpose of parameterless AddCors method?

[voroninp]

I can register cors services without configuring policies:

services.AddCors()

What actually happens under the covers?

Could you add the explanation to this article, please?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 59bca5db-1196-2a8b-a0d8-4e89b2382288
• Version Independent ID: d3f332c4-4c60-039e-0e1e-bc6b11831f87
• Content: Enable Cross-Origin Requests (CORS) in ASP.NET Core
• Content Source: aspnetcore/security/cors.md
• Product: aspnet-core
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[Rick-Anderson]

Via https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.2#enable-cors-with-attributes

You need to add a policy.

[voroninp]

@Rick-Anderson Sorry, but it didn't become clearer =(

There are overloads for both UseCors and AddCors methods which do not accept any parameters. In code snippets AddCors is always called with policies configifuration. UseCors is called differently.

[Rick-Anderson]

@pranavkm what's the purpose of register cors services without configuring policies:

services.AddCors()

[pranavkm]

It's meant for scenarios where the application specifies a custom policy provider that isn't backed by CorsOptions.

[voroninp]

@Rick-Anderson , would be nice to capture that in docs ;-)

[Rick-Anderson]

@pranavkm OK if I add that to the doc?

[pranavkm]

Writing a custom policy provider isn't common and we don't expect most users to write one. AddCors is just as usable if you separately register the options type later. It's also usable if you write middleware that expects users to separately configure CORS. There could be others I'm not aware of.

I'd be happy to entertain documenting it if it were part of a coherent document that says if you were doing this scenario and happen to require CORS, here's what you would need to do. But adding docs that says you might use this overload in these non-exhaustive cases is helpful to anyone.

[Rick-Anderson]

Thanks @pranavkm . This issue is very discoverable and will serve as the documentation.

[voroninp]

@Rick-Anderson

In ConfigureServices I an write:

services.AddCors(options =>
{
    options.AddDefaultPolicy(builder => builder.AllowAnyOrigin().AllowAnyMethod());
});

and in Configure:

app.UseCors(builder => builder.AllowAnyOrigin().AllowAnyMethod());

I still do not get how do these calls relate to each other. They seem to do the same thing. Or not?

[Rick-Anderson]

@voroninp you're calling AllowAnyOrigin().AllowAnyMethod() off two different methods.

[voroninp]

@Rick-Anderson ,
This discussion makes me feel like this guy =)

off two different methods?

Yes, UseCors and AddCors. But what is for what? How does semantic of these calls differ? In both cases I am working with PolicyBuilder. Which call do I need when?