Cross-origin resource sharing (CORS) & Web API

Question

Hi,

Why CORS Is needed in WEB API?

Any clair and good documentation ?

Thank you !

Answer 1

For the API side of things CORS is just a header you add to the response so that any browser that implements CORS will check for. If no CORS is enabled on your API, then a browser will not accept any responses from your API. Either you can add the domain name of the web application to the Access-Control-Allow-Origin header value, or a wild card i.e. "*" if you want the API to be used by any web application.

Answer 2

Cross Origin Resource Sharing (CORS) is a W3C standard that allows a server to relax the same-origin policy. Using CORS, a server can explicitly allow some cross-origin requests while rejecting others.

This might be helpful https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api