The server responded with a status of 405” + “Access to fetch… from origin … has been blocked by CORS policy

Describe the bug

We have two different asp.net core web api applications employing the following C# code snippet.

public static IServiceCollection AddUniversalCORS(this IServiceCollection services)
            => services.AddCors(setupAction => setupAction.AddPolicy("myPolicy", builder =>
                builder
                    .AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader()));

Also, we have an Angular app that calls both web apis. Making the call to the first web api goes through flawlessly and successfully but the 2nd one fails due to the following error message:

const url = ‘https://localhost:44317/api/logic/save’; const request = { method: ‘POST’, headers: { ‘Content-Type’: ‘application/json’, Authorization: Bearer ${this.authService.getToken()} }, body: JSON.stringify(this.myPayload) };

So, why one of the web api calls is successful but the other one fails due to the CORS error message? Really running out of reasons to justify this issue which made us get stuck for quite a while!

We also consulted StackOverflow to find an answer for this issue but none of the answers helped, unfortunately. As a side note, Submitting the same failed POST request in Angular by POSTMAN goes through successfully.

To Reproduce

Steps to reproduce the behavior:

1. Using this version of ASP.NET Core 2.2

Expected behavior

The CORS should not fail and the angular app should be able to succeed in terms of placing the POST request.

[dcarr42]

The operation is supported.

https://github.com/aspnet/AspNetCore/blob/master/src/Middleware/CORS/src/Infrastructure/CorsService.cs#L120

Just check the outgoing headers to see if anything else needs to be overridden.

[Arash-Sabet]

@DAllanCarr Not 100% following you. Any examples on your recent comment?

/cc @miladghafoori