# CORS when calling API in .net core mvc

**URL:** <https://community.auth0.com/t/cors-when-calling-api-in-net-core-mvc/201118>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [June 24, 2026, 3:48pm UTC](https://community.auth0.com/t/cors-when-calling-api-in-net-core-mvc/201118 "2026-06-24T15:48:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![planyway](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/planyway/32/60075_2.png) [@planyway](https://community.auth0.com/u/planyway)\
**Post date:** [June 24, 2026, 3:48pm UTC](https://community.auth0.com/t/cors-when-calling-api-in-net-core-mvc/201118/1 "2026-06-24T15:48:26Z")

</div>

Below is the code that I use to do protected [ASP.NET](http://ASP.NET) Core MVC login and protected api using the same project (for some reason). The problem is the API only has intended result when the user logged in. If getting them with the test token through curl in swagger UI, I see CORS error. For your reference, the razor views and api do only show results when the user logs in, and the useful codes are quoted here:

```
    builder.Services.Configure<CookiePolicyOptions>(options =>

    {

        options.CheckConsentNeeded = context => true;

        options.MinimumSameSitePolicy = SameSiteMode.None;

    });

```

…  
` builder.Services.AddAuth0WebAppAuthentication(options =>`

```
    {

      options.Domain = builder.Configuration\["Auth0:Domain"\];

      options.ClientId = builder.Configuration\["Auth0:ClientId"\];

      options.ClientSecret = builder.Configuration\["Auth0:ClientSecret"\];

    })

    .WithAccessToken(options =>

    {

      options.Audience = builder.Configuration\["Auth0:Audience"\]; 

    });

    builder.Services.AddAuth0ApiAuthentication("Auth",

        Configuration.GetSection("Auth0"),

        configureJwtBearer: jwt =>

        {

            jwt.TokenValidationParameters = new TokenValidationParameters

            {

                ValidAudiences = new\[\]

                {

                    Configuration\["Auth0:Audience"\]

                }

            };

            jwt.Events = new JwtBearerEvents

            {

                OnMessageReceived = context =>

                {

                    var token = context.Request.Query\["access_token"\].FirstOrDefault();

                    if (string.IsNullOrEmpty(token))

                    {

                        token = context.Request.Headers\["X-API-Token"\].FirstOrDefault();

                    }

                    

                    if (!string.IsNullOrEmpty(token))

                    {

                        context.Token = token;

                    }

                    return Task.CompletedTask;

                }

            };

        }

    );

```

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [June 24, 2026, 10:13pm UTC](https://community.auth0.com/t/cors-when-calling-api-in-net-core-mvc/201118/3 "2026-06-24T22:13:10Z")

</div>

Hi @planyway

1. **The Scheme Conflict:** When you use both `AddAuth0WebAppAuthentication` (cookie-based) and `AddAuth0ApiAuthentication` (JWT Bearer-based) in the same project without explicitly telling your API controllers which scheme to use, [ASP.NET](http://ASP.NET) defaults to the cookie scheme. Curl/Swagger requests using `Bearer` tokens are ignored or rejected.
2. **The CORS Illusion:** The CORS error you see in Swagger is often a “red herring.” When an API request fails authentication (401 Unauthorized), [ASP.NET](http://ASP.NET) Core often short-circuits the pipeline _before_ the CORS headers are appended to the response, causing the browser (or Swagger UI) to report a CORS error instead of an Auth error.

To fix this, we need to explicitly configure your [ASP.NET](http://ASP.NET) Core pipeline so that the MVC pages use cookies, the APIs accept JWT Bearer tokens, and the CORS middleware runs in the correct order.

**Step 1: Explicitly tell your API controllers to accept JWTs**  
Right now, your API controllers are likely just using `[Authorize]`. You must update them to explicitly look for the JWT Bearer scheme that `AddAuth0ApiAuthentication` registered.

Update your API controllers:

```auto
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("api/[controller]")]
// Force this controller to ONLY look at Bearer tokens (not cookies)
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)] 
public class MyProtectedApiController : ControllerBase
{
    // ...
}

```

**Step 2: Fix the Middleware Order (**`Program.cs`**)**  
The order of `app.Use...` statements in [ASP.NET](http://ASP.NET) Core is critical. `UseCors` must come _before_ `UseAuthentication` and `UseAuthorization` so that CORS headers are appended even on 401 responses.

```auto
var app = builder.Build();

app.UseCors("MyCorsPolicy"); 

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.UseSwagger();
app.UseSwaggerUI();

app.MapControllers();
app.MapDefaultControllerRoute();

app.Run();

```

**Step 3: Ensure CORS allows Swagger**  
Make sure your CORS policy (defined in `builder.Services.AddCors`) explicitly allows the origin where Swagger is running (e.g., `https://localhost:5001`), or uses `AllowAnyOrigin()` for local development testing.

If you have any other questions, let me know!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 8, 2026, 10:13pm UTC](https://community.auth0.com/t/cors-when-calling-api-in-net-core-mvc/201118/4 "2026-07-08T22:13:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.