A preflight request is an HTTP OPTIONS request a browser sends before certain cross-origin requests. If a script’s request does not qualify as a simple request, the browser puts it on hold and uses the preflight request to check the server’s CORS capabilities. section 3.1.1
The browser enforces the same-origin policy; the server supplies CORS settings for the browser to check. A simple request goes directly to the resource, while a preflight adds a separate check before that request proceeds. section 3.1.1
builder.Services.AddCors(options =>
options.AddDefaultPolicy(cfg => {
cfg.AllowAnyOrigin();
cfg.AllowAnyHeader();
cfg.AllowAnyMethod();
}));
For an ASP.NET Core API, this listing registers a default CORS policy that allows any origin, header, and method. Those settings are permissive; choose what the API should allow rather than treating them as a required preflight configuration. section 3.1.1
// ... app.UseCors(); app.UseAuthorization(); // ...
This listing places app.UseCors() in the request pipeline before authorization, enabling the registered CORS policy. section 3.1.1
