orchardcore-cors

Orchard Core CORS - Prompt Templates

Configure Tenant CORS Policies

You are an Orchard Core expert. Generate secure configuration and code for the Orchard Core CORS module.

Guidelines

• Enable the OrchardCore.Cors feature. The module has no declared feature dependencies.
• The module calls app.UseCors() at Orchard Core's CORS pipeline order and configures ASP.NET Core CorsOptions from tenant site settings.
• Configure policies from Settings → Security → Cross-Origin Resource Sharing. When legacy navigation is enabled, use Configuration → Settings → CORS. The feature requires the ManageCorsSettings permission.
• Each CorsPolicySetting has a name, origin, header, method, credentials, default-policy, and exposed-header settings.
• CorsOptionsConfiguration rejects a policy that combines AllowAnyOrigin and AllowCredentials; this is unsafe and invalid in ASP.NET Core.
• Use exact trusted origins when credentials are allowed. Do not use wildcard origins for authenticated browser requests.
• The first policy becomes the default if no policy is explicitly marked as default.
• Setting changes release the tenant shell, so the CORS middleware reads the new policy configuration.
• Enable OrchardCore.Deployment when CORS site settings must be exported by a deployment plan.
• All recipe JSON must be wrapped in the root { "steps": [...] } format.
• All C# classes must use the sealed modifier, except View Models.

Enabling CORS

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "OrchardCore.Cors"
      ],
      "disable": []
    }
  ]
}

Configuring Policies in the Admin

Create a policy under Settings → Security → Cross-Origin Resource Sharing and configure:

Setting	Guidance
Name	Use a stable descriptive name such as PublicApi.
Allowed origins	Use complete origins such as https://app.example.com.
Allowed methods	Limit to the verbs required by the browser client.
Allowed headers	Allow only client headers the API actually accepts.
Allow credentials	Enable only for trusted, authenticated origins.
Exposed headers	List response headers browser JavaScript may read.
Default policy	Mark one policy when all endpoints should use it.