Blog

CORS and Security in ASP.NET Core Web API: HTTPS, HSTS, Headers and Secrets

We see with curl why CORS is not a firewall, define a policy and read the preflight request. HTTPS redirection, the localhost exception in HSTS, security headers and user secrets are covered too.