--- title: CORS in ASP.NET Core | daily.dev description: A practical walkthrough of Cross-Origin Resource Sharing (CORS) in ASP.NET Core, explaining what CORS is, why browsers enforce the Same-Origin Policy, and how... canonical: https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CORS in ASP.NET Core | daily.dev og:description: A practical walkthrough of Cross-Origin Resource Sharing (CORS) in ASP.NET Core, explaining what CORS is, why browsers enforce the Same-Origin Policy, and how... og:url: https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys og:image: https://api.daily.dev/og/posts/8uIbyK7yS.png og:image:alt: CORS in ASP.NET Core og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CORS in ASP.NET Core **[NikolaTech](https://daily.dev/sources/nikolatech)** · 4 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of Cross-Origin Resource Sharing (CORS) in ASP.NET Core, explaining what CORS is, why browsers enforce the Same-Origin Policy, and how to configure CORS policies with AddCors(). Covers applying CORS via middleware, controller attributes ([EnableCors]/[DisableCors]), and minimal endpoints (RequireCors()), plus how preflight OPTIONS requests work and how to configure preflight cache duration with SetPreflightMaxAge(). Includes a linked source code example. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable CORS for only specific endpoints in ASP.NET Core minimal APIs? Use the RequireCors() extension method on a route group or individual endpoint, passing the name of a policy registered via AddCors(). For example, app.MapGroup("products").RequireCors("CorsPolicy") applies the named policy to all routes in that group, while calling RequireCors on a single MapGet applies it only to that endpoint. _daily.dev surfaces ASP.NET Core guidance like this for developers wiring up endpoint-level CORS._ ### How do I control CORS per controller in ASP.NET Core with attributes? Apply the [EnableCors("PolicyName")] attribute to a controller or action to enable a specific named CORS policy, or use [DisableCors] to exclude an endpoint from a globally applied policy. This requires the policy to be registered first with AddCors() and AddPolicy(), and gives finer control than applying CORS globally through middleware. _Developers structuring controller-level security often check ASP.NET Core patterns like this on daily.dev._ ### How do I set the preflight request cache duration in ASP.NET Core CORS policies? Call SetPreflightMaxAge() when building a CORS policy, passing a TimeSpan such as TimeSpan.FromSeconds(2520), which sets the Access-Control-Max-Age header telling the browser how long it can cache the preflight OPTIONS response before sending another one for the same origin and request type. _daily.dev helps backend engineers tuning CORS and preflight behavior keep these details handy._ ## Similar posts on daily.dev - [How to use CORS in ASP.NET Core minimal APIs](https://daily.dev/posts/how-to-use-cors-in-asp-net-core-minimal-apis-ojcsjx0hm) · InfoWorld · 1 upvotes · 0 comments - [CORS in ASP.NET Core \(.NET 10\) - Cross-Origin Done Right](https://daily.dev/posts/cors-in-asp-net-core-net-10---cross-origin-done-right-yhzuttdec) · Code with Mukesh · 15 upvotes · 0 comments - [CORS & SOP: Backbone of web security](https://daily.dev/posts/cors-sop-backbone-of-web-security-6degcg1wk) · InfoSec Write-ups · 0 upvotes · 0 comments - [Correct Order for CORS, Authentication, and Authorization in ASP.NET Core](https://daily.dev/posts/correct-order-for-cors-authentication-and-authorization-in-asp-net-core-8zxkwml07) · C\# Corner · 0 upvotes · 0 comments - [A modern approach to preventing CSRF in Go– Alex Edwards](https://daily.dev/posts/a-modern-approach-to-preventing-csrf-in-go-alex-edwards-5b32watfz) · Lobsters · 1 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net), [#c#](https://daily.dev/tags/c#), [#aspnet](https://daily.dev/tags/aspnet) [View this post on daily.dev](https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CORS in ASP.NET Core","url":"https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys"},"datePublished":"2026-10-04T13:05:46.785Z","dateModified":"2026-10-04T13:13:06.270Z","description":"A practical walkthrough of Cross-Origin Resource Sharing (CORS) in ASP.NET Core, explaining what CORS is, why browsers enforce the Same-Origin Policy, and how...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/19de5f62ce10d8387a561fe25c41c445?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/19de5f62ce10d8387a561fe25c41c445?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"NikolaTech","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NikolaTech","logo":"https://media.daily.dev/image/upload/s--1h2fO6FL--/f_auto,q_auto/v1791119050/logos/nikolatech?_a=BAMAMicg0","url":"https://daily.dev/sources/nikolatech"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net,c#,aspnet","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NikolaTech","item":"https://daily.dev/sources/nikolatech"},{"@type":"ListItem","position":3,"name":"CORS in ASP.NET Core"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cors-in-asp-net-core-8uibyk7ys#faq","mainEntity":[{"@type":"Question","name":"How do I enable CORS for only specific endpoints in ASP.NET Core minimal APIs?","acceptedAnswer":{"@type":"Answer","text":"Use the RequireCors() extension method on a route group or individual endpoint, passing the name of a policy registered via AddCors(). For example, app.MapGroup(\"products\").RequireCors(\"CorsPolicy\") applies the named policy to all routes in that group, while calling RequireCors on a single MapGet applies it only to that endpoint. daily.dev surfaces ASP.NET Core guidance like this for developers wiring up endpoint-level CORS."}},{"@type":"Question","name":"How do I control CORS per controller in ASP.NET Core with attributes?","acceptedAnswer":{"@type":"Answer","text":"Apply the [EnableCors(\"PolicyName\")] attribute to a controller or action to enable a specific named CORS policy, or use [DisableCors] to exclude an endpoint from a globally applied policy. This requires the policy to be registered first with AddCors() and AddPolicy(), and gives finer control than applying CORS globally through middleware. Developers structuring controller-level security often check ASP.NET Core patterns like this on daily.dev."}},{"@type":"Question","name":"How do I set the preflight request cache duration in ASP.NET Core CORS policies?","acceptedAnswer":{"@type":"Answer","text":"Call SetPreflightMaxAge() when building a CORS policy, passing a TimeSpan such as TimeSpan.FromSeconds(2520), which sets the Access-Control-Max-Age header telling the browser how long it can cache the preflight OPTIONS response before sending another one for the same origin and request type. daily.dev helps backend engineers tuning CORS and preflight behavior keep these details handy."}}]} ```