dotnet / dotnet/aspnetcore

Add support for Private Network Access (CORS header Access-Control-Allow-Private-Network)

Open
#40,869 8 comments 7 reactions 0 assignees View on GitHub
area-middleware feature-cors
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I am trying to reach my ASP.NET core api running on https://localhost:5001/ from a SPA which is hosted on another domain (although same computer for me) and I get a CORS error.

### Describe the solution you'd like

I would like to propose that we extend the `CorsPolicy` with the boolean property `AllowPrivateNetworkAccess` and `CorsPolicyBuilder` with the method `WithPrivateNetworkAccess` which the `CorsService` uses to set the `Access-Control-Allow-Private-Network: true` on preflight requests if the browser sends the `Access-Control-Request-Private-Network: true` header in the request.

### Additional context

Link to WICG Draft: https://wicg.github.io/private-network-access/
Link to Chrome developer article about the feature and roll out: https://developer.chrome.com/blog/private-network-access-preflight/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.