outline	2 3
title	CORS Configuration
titleTemplate	NpgsqlRest
description	Configure Cross-Origin Resource Sharing (CORS) for NpgsqlRest. Control allowed origins, methods, headers, and credentials for cross-domain API access.
head	meta name content keywords npgsqlrest cors, postgresql api cors, cross-origin resource sharing, rest api cors config, allowed origins api meta property content og:title NpgsqlRest CORS Configuration meta property content og:description Configure CORS for cross-domain API access. Control allowed origins, methods, headers, and credentials. meta property content og:type article

CORS

Cross-Origin Resource Sharing (CORS) configuration for controlling access from different origins.

Overview

{
  "Cors": {
    "Enabled": false,
    "AllowedOrigins": [],
    "AllowedMethods": ["*"],
    "AllowedHeaders": ["*"],
    "AllowCredentials": false,
    "PreflightMaxAgeSeconds": 600
  }
}

Settings Reference

Setting	Type	Default	Description
Enabled	bool	false	Enable Cross-Origin Resource Sharing (CORS) support.
AllowedOrigins	array	[]	List of allowed origins for CORS requests. Empty array allows no origins.
AllowedMethods	array	["*"]	List of allowed HTTP methods for CORS requests.
AllowedHeaders	array	["*"]	List of allowed headers for CORS requests.
AllowCredentials	bool	false	Allow credentials (cookies, authorization headers) in CORS requests. Disabled by default (changed in 3.17.0); enable deliberately and only together with an explicit AllowedOrigins list.
PreflightMaxAgeSeconds	int	600	Maximum age in seconds for preflight request caching (10 minutes).

Allowed Origins

Specify which origins can make cross-origin requests:

{
  "Cors": {
    "Enabled": true,
    "AllowedOrigins": [
      "https://example.com",
      "https://app.example.com"
    ]
  }
}

::: warning An empty AllowedOrigins array allows no origins. You must specify at least one origin when CORS is enabled. :::

Allow All Origins

To allow requests from any origin (not recommended for production with credentials):

{
  "Cors": {
    "Enabled": true,
    "AllowedOrigins": ["*"],
    "AllowCredentials": false
  }
}

::: danger Using "*" for origins with AllowCredentials: true is not allowed by browsers and will cause CORS errors. :::

Allowed Methods

Specify which HTTP methods are permitted:

{
  "Cors": {
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE"]
  }
}

Use ["*"] to allow all methods.

Allowed Headers

Specify which request headers are permitted:

{
  "Cors": {
    "AllowedHeaders": ["Content-Type", "Authorization", "X-Requested-With"]
  }
}

Use ["*"] to allow all headers.

Credentials

When AllowCredentials is true, the browser includes cookies and authorization headers in cross-origin requests. This requires specific origins (not "*").

::: warning Default changed in 3.17.0 AllowCredentials now defaults to false. Credentials in cross-origin requests must be enabled deliberately, and only together with an explicit AllowedOrigins list. If you relied on the old default, set "AllowCredentials": true explicitly. :::

Preflight Caching

The PreflightMaxAgeSeconds setting controls how long browsers cache preflight (OPTIONS) request responses. Higher values reduce preflight requests but delay CORS policy changes from taking effect.

Example Configuration

Production configuration with specific origins:

{
  "Cors": {
    "Enabled": true,
    "AllowedOrigins": [
      "https://myapp.com",
      "https://admin.myapp.com"
    ],
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE"],
    "AllowedHeaders": ["Content-Type", "Authorization"],
    "AllowCredentials": true,
    "PreflightMaxAgeSeconds": 3600
  }
}

Development configuration allowing all origins:

{
  "Cors": {
    "Enabled": true,
    "AllowedOrigins": ["*"],
    "AllowedMethods": ["*"],
    "AllowedHeaders": ["*"],
    "AllowCredentials": false,
    "PreflightMaxAgeSeconds": 600
  }
}

Related

• Comment Annotations Guide - How annotations work
• Configuration Guide - How configuration works

Next Steps

• Server & SSL - Configure HTTPS and Kestrel web server
• Authentication - Configure authentication methods