How deeply does Building Web APIs with ASP.NET Core cover cross-origin policy?

Defines origin matching and shows CORS policy configuration without detailing browser enforcement internals.

Cross-origin policy

As explained in Building Web APIs with ASP.NET Core

The same-origin policy is a browser security rule that restricts scripts from accessing resources unless their protocol, host, and port origins match.

The same-origin policy restricts requests made by browser scripts. A page and a requested resource have the same origin only when their protocol, host, and port, if specified, match. A script requesting a resource from another origin needs a mechanism such as CORS. section 3.1.1

A board-game app on another domain

A page at webapp.com loads an Angular app, which requests board games from mybglist-api.com/BoardGames. That API request crosses origins, unlike requests for the page’s own app.js and style.css files. section 3.1.1

To allow the browser app to use the API in ASP.NET Core:

Register a CORS policy with AddCors; use WithOrigins to name an allowed origin, or AllowAnyOrigin for an unrestricted policy. section 3.1.1
Enable the policy with app.UseCors(), or apply a named policy to selected endpoints with RequireCors. section 3.1.1

How Building Web APIs with ASP.NET Core covers it

Cover of Building Web APIs with ASP.NET Core

liveBook manning.com

Read Building Web APIs with ASP.NET Core on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

ASP.NET Core in Action, 3eThe same-origin policy is a browser security restriction that limits scripts' access to resources from a different origin unless that access is explicitly permitted.

Compare how 2 books explain cross-origin policy →

Related concepts

CORSaddressed by · Cross-Origin Resource Sharing (CORS) is a web standard that uses HTTP headers to let servers specify which origins may access their resources through browsers.
originconfigures · A web origin is the security identity defined by a resource's scheme, host, and port.
JavaScriptconfigures · JavaScript is a high-level, dynamically typed, multi-paradigm programming language standardized as ECMAScript and used for web and general-purpose programming.
browserused by · A web browser is software that retrieves, interprets, and renders web resources, executes supported web content, and enables interaction with web pages and applications.

This explainer was generated by Manning's knowledge graph from the text of Building Web APIs with ASP.NET Core. The section links point to the parts of the book it draws on.