diff --git a/aspnetcore/fundamentals/middleware/index.md b/aspnetcore/fundamentals/middleware/index.md index 91a1514382..c0746911be 100644 --- a/aspnetcore/fundamentals/middleware/index.md +++ b/aspnetcore/fundamentals/middleware/index.md @@ -181,6 +181,10 @@ app.MapRazorPages(); For information about Single Page Applications, see the guides for the [React](xref:spa/react) and [Angular](xref:spa/angular) project templates. +## UseCors and UseStaticFiles order + +The order for calling `UseCors` and `UseStaticFiles` depends on the app. For more information, see [UseCors and UseStaticFiles order](xref:security/cors#uc1) + ### Forwarded Headers Middleware order [!INCLUDE[](~/includes/ForwardedHeaders.md)] diff --git a/aspnetcore/security/cors.md b/aspnetcore/security/cors.md index b7b0ffed43..36f842def7 100644 --- a/aspnetcore/security/cors.md +++ b/aspnetcore/security/cors.md @@ -90,6 +90,12 @@ The methods ca Note: The specified URL must **not** contain a trailing slash (`/`). If the URL terminates with `/`, the comparison returns `false` and no header is returned. + + +## UseCors and UseStaticFiles order + +Typically, `UseStaticFiles` is called before `UseCors`. Apps that use JavaScript to retrieve static files cross site must call `UseCors` before `UseStaticFiles`. + ### CORS with default policy and middleware