CORS Policy has been blocked my subdomain

Question

I have a same domain, one of them is domain without prefix www. For example,

1. https://www.example.com
2. https://example.com

First domain works

Answer 1

You can't use AllowAnyOrigin with AllowCredentials. Below is an example that allows wildcard domains with CORS.

This code goes in ConfigureServices:

services.AddCors(options =>
        {
            options.AddPolicy("_AllowOrigin",
                builder => builder
                    .SetIsOriginAllowedToAllowWildcardSubdomains()
                    .WithOrigins("https://localhost:44385", "https://*.azurewebsites.net", "http://*.azurewebsites.net")
                    .AllowAnyHeader()
                    .AllowAnyMethod()
                    .AllowCredentials()
                );
        });

Don't forget to decorate your action in your controller:

    [EnableCors("_AllowOrigin")]