Search code examples
.netcontrollercors

How many urls/origins can you have for EnableCors?

In a .NET (C#) api, how many origins can I have listed under an EnableCors attribute.

Disclaimer: I'm asking for the attribute EnableCors, not the CorsPolicy

I am opening an API to additional sites and starting receiving CORS errors from all the sources. I tracked it down to an issue with the number of urls I had list in the EnableCors url. I determined I can have at most 39 urls in the attribute. More than 39 urls caused the CORS errors, even though the site built without error.

Solution

  • I couldn't find this answer online, so I created this question in stackoverflow after testing myself. As mentioned in the question,

    you can have at most 39 urls as the origins in the EnableCors attribute.

    For me, I was able to reduce the number of urls based on build versions. If you cannot reduce the number of origins, you may be able to setup a cors policy that handles more than 40, though I have not tested it.