Asp.Net CORS安全问题

Question

我在我的asp.net核心API中制定了一个CORS策略，但是这个API似乎对公众是可访问的，因为我只需在浏览器中输入API就可以看到这个JSON。所以我只想让我的前端(它是同一个API主机中的一个有角度的应用程序)能够访问API，而不是每个人。这是我的入门课：

public class Startup
{
    readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy(name: MyAllowSpecificOrigins,
                              builder =>
                              {
                                  builder.WithOrigins("myurl")
                                   .AllowAnyHeader()
                                   .AllowAnyMethod(); 
                              });
        });
        services.AddControllers().AddJsonOptions(options =>
        {
            options.JsonSerializerOptions.PropertyNamingPolicy = null;
            options.JsonSerializerOptions.DictionaryKeyPolicy = null;
        });

        services.Configure<FormOptions>(o =>
        {
            o.ValueLengthLimit = int.MaxValue;
            o.MultipartBodyLengthLimit = int.MaxValue;
            o.MemoryBufferThreshold = int.MaxValue;
        });

        services.AddControllers();
        string connectionString = "xxx";
        services.AddDbContext<decorContext>(
          option => option.UseSqlServer(connectionString)
            );
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
       
        app.UseDefaultFiles();
        app.UseStaticFiles();
       
        app.UseStaticFiles(new StaticFileOptions()
        {
            FileProvider = new PhysicalFileProvider(Path.Combine(Directory.GetCurrentDirectory() ,@"StaticFiles")),
            RequestPath = new PathString("/StaticFiles")
        });

        app.UseRouting();
        app.UseCors(MyAllowSpecificOrigins);
        app.UseAuthorization();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

Answer 1

当域A访问域B(比如在js中进行ajax调用)时，CORS就会被踢进来，当您直接访问url时，它就不适用了。这就是为什么它被称为交叉起源。

您通常不会实现“脚本->网站”限制。您可以通过位置/IP、用户标识/角色/声明或检查请求中是否存在防伪令牌来限制访问。查看ASP.NET核心安全概述