在 ASP.NET 核心 MVC 项目上启用 CORS

Posted 2023-03-04

【中文标题】在 ASP.NET 核心 MVC 项目上启用 CORS

【英文标题】：Enable CORS on an ASP.NET core MVC project

【发布时间】：2020-12-06 00:37:38

【问题描述】：

当我终于明白我的问题是 CORS 阻止了我时，我需要将用户重定向到另一个页面也许有人能发现我的错误？

  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    
        if (env.IsDevelopment())
        
            app.UseDeveloperExceptionPage();
            app.UseBrowserLink();
        
        else
        
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        
        app.UseHttpsRedirection();
        _scheduler.JobFactory = new AspnetCoreJobFactory(app.ApplicationServices);
        app.UseSession();
        app.UseStaticFiles();
        app.UseCors(MyAllowSpecificOrigins);
        app.UseAuthentication();
        app.UseRouting();
        app.UseAuthorization();
        app.UseCookiePolicy();
        app.UseEndpoints(endpoints =>
        
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "controller=Users/action=Dashboard/id?");
        );
    

public void ConfigureServices(IServiceCollection services)
    
        FACEBOOK_APP_ID = _config.GetValue<string>("FACEBOOK_APP_ID");
        FACEBOOK_APP_SECRET = _config.GetValue<string>("FACEBOOK_APP_SECRET");
        services.AddHttpsRedirection(options =>
        
            options.RedirectStatusCode = StatusCodes.Status307TemporaryRedirect;
            options.HttpsPort = 44300;
        );
        services.AddHttpClient();
        services.AddCors(options =>
        
            options.AddPolicy(name: MyAllowSpecificOrigins,
                              builder =>
                              
                                  builder.AllowAnyOrigin()
           .AllowAnyMethod()
           .AllowAnyHeader();
                              );
        );
        services.AddMvc();
        services.AddIdentity<ApplicationUser, IdentityRole>(options => options.User.AllowedUserNameCharacters = null).AddEntityFrameworkStores<AppDbContext>();
        services.AddControllersWithViews();
        services.AddDbContextPool<AppDbContext>(options => options.UseSqlServer(_config.GetConnectionString("AutoLoverDbConnection"), x => x.MigrationsAssembly("AutoMatcherProjectAss")).UseQueryTrackingBehavior(QueryTrackingBehavior.NoTracking));
        services.AddTransient<AppDbContext>();
        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
        services.AddSingleton<IActionContextAccessor, ActionContextAccessor>();
        services.AddSingleton<ISessionManager, ClientSIdeSessionManager>();
        services.AddHttpContextAccessor();
        services.AddSession();
        services.Configure<CookiePolicyOptions>(options =>
        
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => false;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        );
        services.AddDistributedMemoryCache();
        services.AddSession(options =>
        
            options.IdleTimeout = TimeSpan.FromMinutes(60);//You can set Time   
            options.Cookie.HttpOnly = true;
        );
        services.AddTransient<ISche, SchedulerImpl>();
        services.AddTransient<IQueue, QueueImpl>();
        services.AddTransient<SchedulerJob>();
        services.AddTransient<IBotFactory, BotFactory>();
        services.AddTransient<IJsonFactory, JsonFactory>();
        services.AddTransient<ICredentialDb, CredentialDb>();
        services.AddSingleton(provider => _scheduler);
        services.AddAuthentication().AddFacebook(options =>
        
            options.AppId = FACEBOOK_APP_ID;
            options.AppSecret = FACEBOOK_APP_SECRET;
            options.SaveTokens = true;

        );

        _scheduler.Clear();
    

控制器：

    [HttpPost]
    public async Task<IActionResult> AuthenticateInstagramAPI(Service service)
    

        return new RedirectResult("https://www.instagram.com/");

    

错误：

从源“https://localhost:44300”访问“https://www.instagram.com/”（从“https://localhost:44300/Actions/AuthenticateInstagramAPI”重定向）的 XMLHttpRequest 已被阻止通过 CORS 策略：在预检响应中 Access-Control-Allow-Headers 不允许请求标头字段 x-requested-with。

编辑----------

客户端 AJAX 调用：

function AuthInstagram() 
    var service = $('#userServicesDropDownAuth :selected').text()
    $.ajax(
        url: '/Actions/AuthenticateInstagramAPI',
        method: 'POST',
        data: service ,
        dataType: 'json',
        success: function (data) 
            console.log(data);
        ,
        error: function (error) 
            //alert(error+"11");
        
    )   

【问题讨论】：

你看过***.com/questions/31942037/…吗？

可以分享客户端代码吗？

@taylorswiftfan 是的，没用。

@YiyiYou yes 正在编辑

【参考方案1】：

在您的 startup.cs 中。您将 app.UseCors(MyAllowSpecificOrigins); 放在 app.UseStaticFiles(); 和 app.UseAuthentication(); 之间

而在doc,Calls the UseCors extension method and specifies the _myAllowSpecificOrigins CORS policy. UseCors adds the CORS middleware. The call to UseCors must be placed after UseRouting, but before UseAuthorization. For more information, see Middleware order.

所以你可以像这样改变你的数据：

    app.UseRouting();

    app.UseCors(MyAllowSpecificOrigins);


    app.UseAuthorization();

【参考方案2】：

想通了。

事实证明，如果您向控制器操作发送 AJAX 获取请求，并尝试从该操作重定向它不会起作用。 可能是 AJAX 添加了一些标头，或者 AJAX 调用没有通过中间件管道？不知道，如果有人知道我为什么会应用它的答案！