From 07fec89d7ea03c554d21429c912a0d168315c41a Mon Sep 17 00:00:00 2001 From: Rick Anderson <3605364+Rick-Anderson@users.noreply.github.com> Date: Mon, 4 Apr 2022 08:00:34 -1000 Subject: [PATCH] Cors and UseStaicFiles order /3 (#25490) * Cors and UseStaicFiles order /3 * Cors and UseStaicFiles order /3 * Cors and UseStaicFiles order /3 --- aspnetcore/fundamentals/middleware/index.md | 4 ++++ aspnetcore/security/cors.md | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/aspnetcore/fundamentals/middleware/index.md b/aspnetcore/fundamentals/middleware/index.md index 91a1514382..c0746911be 100644 --- a/aspnetcore/fundamentals/middleware/index.md +++ b/aspnetcore/fundamentals/middleware/index.md @@ -181,6 +181,10 @@ app.MapRazorPages(); For information about Single Page Applications, see the guides for the [React](xref:spa/react) and [Angular](xref:spa/angular) project templates. +## UseCors and UseStaticFiles order + +The order for calling `UseCors` and `UseStaticFiles` depends on the app. For more information, see [UseCors and UseStaticFiles order](xref:security/cors#uc1) + ### Forwarded Headers Middleware order [!INCLUDE[](~/includes/ForwardedHeaders.md)] diff --git a/aspnetcore/security/cors.md b/aspnetcore/security/cors.md index b7b0ffed43..36f842def7 100644 --- a/aspnetcore/security/cors.md +++ b/aspnetcore/security/cors.md @@ -90,6 +90,12 @@ The methods ca Note: The specified URL must **not** contain a trailing slash (`/`). If the URL terminates with `/`, the comparison returns `false` and no header is returned. + + +## UseCors and UseStaticFiles order + +Typically, `UseStaticFiles` is called before `UseCors`. Apps that use JavaScript to retrieve static files cross site must call `UseCors` before `UseStaticFiles`. + ### CORS with default policy and middleware