Chapter 5. CORS in Windows

In this chapter, we are going to discuss how to implement CORS on the Windows platform. The Windows platform includes IIS and ASP.NET Web API applications, as well as the Windows Communication Foundation.

We will learn about:

• How to set the Access-Control-Allow-Origin header globally in web.config for Windows IIS Server

• How to install and use the Microsoft ASP.NET Web API Cross-Origin Support package, including:

  • Setting CORS policies with the EnableCorsAttribute class

  • Disabling CORS policies with the DisableCors attribute

  • Creating dynamic CORS policies with the Custom CORS Policy Attribute class

  • Creating dynamic CORS policies driven by logic with the custom CORS policy provider factory

• How to use CORS in Windows Communication Foundation (WCF)

• Note that Edge and Internet Explorer 10 fully support XmlHttpRequest withCredentials, IE 8 and 9 use XDomainRequest instead of XmlHttpRequest, and IE 7 and lesser versions do not support CORS at all

Incoming CORS requests

Web applications are often integrated with external platforms, APIs, and services. When the external source is hosted on a different domain, CORS is used to allow requests from the external local domain to the target domain, without an intermediate proxy. We will look at techniques for allowing cross-domain requests in Windows applications and servers. When making a CORS request from the Windows application as the local domain to a different target domain, it is handled with custom code using the methods we have covered in earlier chapters.

How to set the Access-Control-Allow-Origin header globally in Windows IIS Server

Although it is possible to set the Access-Control-Allow-Origin header value globally in web.config for Windows IIS Server, the Microsoft ASP.NET Web API Cross-Origin Support package provides classes and interfaces for the sophisticated handling of CORS requests.

Tip

In general, best practices for CORS recommend setting the CORS-enabling Access-Control-Allow-Origin header only on pages where it is actually needed, rather than setting it globally on every page. Also consider the security implications of allowing CORS requests globally, particularly when using the wildcard "*".

You may also allow a single domain instead of allowing all domains with the wildcard. Until the CORS specification supporting multiple allowed domains is widely supported in client browsers, you will need to use additional logic in code to allow a specific set of allowed domains.

Setting CORS headers globally with web.config for IIS7 Server...

CORS in the ASP.NET Web API

The ASP.NET Web API is a HTTP service-oriented framework suitable for implementing cross-domain requests via CORS in web applications.

ASP.NET Web API is a framework that makes it easy to build HTTP services that reach a broad range of clients, including browsers and mobile devices. ASP.NET Web API is an ideal platform for building RESTful applications on the .NET Framework.

The EnableCorsAttribute custom class contains properties for the allowed origins, HTTP methods, request headers, response headers, and whether credentials are allowed.

The CorsMessageHandler checks the policy in the attribute for the HTTP method being invoked and sends the appropriate CORS response headers.

Enabling CORS in the ASP.NET Web API

When using the ASP.NET Web API, you may enable CORS globally on the IIS server using the methods already discussed.

It is preferable to add the CORS headers only on the pages, and for classes and methods, where they are needed. The next section shows how to...

CORS in Windows Communication Foundation

Windows Communication Foundation (WCF) is another service-oriented Windows .NET framework component that is suitable for building applications that use CORS.

The WCF sends data as asynchronous messages from one service endpoint to another. A service endpoint can be hosted by IIS, or it can be hosted in an application. It can be a client of a service that requests data from a service endpoint.

Out of the box, WCF cannot make cross-origin requests because it does not send the required CORS headers: Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Methods. WCF can also send the optional CORS headers: Access-Control-Allow-Headers and Access-Control-Max-Age.

Create a global.asax file to add the necessary HTTP headers to Application_BeginRequest. The following example of code for the global.asax file allows a request from http://localdomain.com, using allowed HTTP methods POST, PUT, DELETE. It allows http://localdomain.com...

CORS in Windows browsers – Internet Explorer and Edge

The good news is that Edge, the browser that ships with Windows 10, and Internet Explorer 10 fully support the W3C specification for CORS, and you can use standard techniques with XmlHttpRequest (XHR) and CORS headers. Internet Explorer 7 and older versions do not support CORS at all.

According to Can I Use... (as of August 2015), CORS is supported by 97.69% of browsers in the USA and 92.76% globally. For more information about CORS support in browsers, see the Can I Use... page for CORS: .

In Internet Explorer 8 and 9, you have to use feature detection and XDomainRequest instead of XHR. We covered using XDomainRequest in Chapter 1, Why You Need CORS.

The following example shows how to detect XHR withCredentials and XDomainRequest support. If a new XmlHttpRequest has "withCredentials", then CORS is supported; if the window has XDomainRequest, then that method is supported; if neither is present, you cannot use CORS:

function browserSupportsCors...

Summary

Interesting isn't it?

In this chapter, we have learned about how to allow incoming CORS requests in the Windows IIS server by adding the CORS headers in the web.config file.

Then we discussed how to use the REST features in the ASP.NET Web API framework to enable CORS.

Next, we learned about using CORS in the Windows Communication Foundation (WCF).

Finally, we discussed CORS support in Edge and Internet Explorer 10 browsers.