Projects targeting .NET Core should use the [TFM](/dotnet/standard/frameworks#referring-to-frameworks) of a version greater than or equal to .NET Core 2.2. In the project file, update the `<TargetFramework>` node's inner text with `netcoreapp2.2`:
To adopt the [in-process hosting model for IIS](xref:fundamentals/servers/index#in-process-hosting-model), add the `<AspNetCoreHostingModel>` property with a value of `InProcess` to a `<PropertyGroup>` in the project file:
If targeting .NET Core, remove the metapackage reference's `Version` attribute in the project file. Inclusion of a `Version` attribute results in the following warning:
A PackageReference to 'Microsoft.AspNetCore.App' specified a Version of `2.2.0`. Specifying the version of this package is not recommended. For more information, see https://aka.ms/sdkimplicitrefs
If targeting .NET Framework, update each package reference's `Version` attribute to 2.2.0 or later. Here are the package references in a typical ASP.NET Core 2.2 project targeting .NET Framework:
If referencing the [Microsoft.AspNetCore.Razor.Design](https://www.nuget.org/packages/Microsoft.AspNetCore.Razor.Design/) package, update its `Version` attribute to 2.2.0 or later. Failure to do so results in the following error:
```console
Detected package downgrade: Microsoft.AspNetCore.Razor.Design from 2.2.0 to 2.1.2. Reference the package directly from the project to select a different version.
If your solution relies upon a [global.json](/dotnet/core/tools/global-json) file to target a specific .NET Core SDK version, update its `version` property to the 2.2 version installed on your machine:
If the app calls <xref:Microsoft.AspNetCore.Hosting.WebHostBuilderKestrelExtensions.UseKestrel*> by calling `CreateDefaultBuilder` in the [CreateWebHostBuilder method](xref:fundamentals/host/web-host#set-up-a-host) of the `Program` class, call `ConfigureKestrel` to configure Kestrel server instead of `UseKestrel` in order to avoid conflicts with the [IIS in-process hosting model](xref:fundamentals/servers/index#in-process-hosting-model):
If the app doesn't call `CreateDefaultBuilder` and builds the host manually in the `Program` class, call <xref:Microsoft.AspNetCore.Hosting.WebHostBuilderKestrelExtensions.UseKestrel*>**before** calling `ConfigureKestrel`:
In ASP.NET Core 2.2, the CORS middleware responds with a wildcard origin (`*`) if a policy allows any origin and allows credentials. Credentials aren't supported when a wildcard origin (`*`) is specified, and browsers will disallow the CORS request. For more information, including options for correcting the problem on the client, see the [MDN web docs](https://developer.mozilla.org/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials).
To correct this problem on the server, take one of the following actions:
* Modify the CORS policy to no longer allow credentials. That is, remove the call to <xref:Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowCredentials*> when configuring the policy.
* If credentials are required for the CORS request to succeed, modify the policy to specify allowed hosts. For example, use `builder.WithOrigins("https://api.example1.com", "https://example2.com")` instead of using <xref:Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyOrigin*>.
Visual Studio's **Auto build on browser request** experience doesn't function with the [IIS in-process hosting model](xref:fundamentals/servers/index#in-process-hosting-model). You must manually rebuild the project when using in-process hosting. Improvements to this experience are planned for a future release of Visual Studio.