IdentityServer 4 - CORS

If an endpoint is called via Ajax calls from JavaScript-based clients, CORS configuration is required.

This can be done by setting the AllowedCorsOrigins collection on the client configuration. IdentityServer will consult these values to allow cross-origin calls from the origins.

	new Client
	{
	ClientId = "angularClient",
	ClientName = "JavaScript Client",
	RequireConsent=true,
	AllowedGrantTypes = GrantTypes.Implicit,
	AllowAccessTokensViaBrowser = true,
	RedirectUris = { "http://localhost:4200" },
	PostLogoutRedirectUris = { "http://localhost:4200" },
	AllowedCorsOrigins = { "http://localhost:4200" },
	AllowedScopes =
	{
	IdentityServerConstants.StandardScopes.OpenId,
	IdentityServerConstants.StandardScopes.Profile,
	IdentityServerConstants.StandardScopes.Email,
	"api1"
	}
	}

view raw ClientConfig.cs hosted with ❤ by GitHub

Remark: Be sure to use an origin (not a URL) when configuring CORS. For example: https://foo:123/ is a URL, whereas https://foo:123 is an origin.