OidcCorsOptions Class
Host-configurable inputs for the default CORS policy (CorsPolicyName) that the MVC and Minimal API adapters register for the OIDC endpoints.
public sealed class OidcCorsOptionsInheritance System.Object → OidcCorsOptions
Remarks
A host controls the policy at two levels, and both are honoured whether one adapter is used or both:
- Supplement the default by configuring this type, e.g.
services.Configure<OidcCorsOptions>(o => o.AllowedOrigins.Add("https://spa.example.com")). Both adapters build the default policy from the same options, so the restriction applies uniformly. - Override the default entirely by registering a CORS policy named
CorsPolicyName, e.g.
services.AddCors(o => o.AddPolicy(...)). A host-defined policy of that name always wins, in any registration order, because the adapters fill the default only when the host has not defined one.
Properties
OidcCorsOptions.AllowedOrigins Property
Origins allowed to read the OIDC endpoints from a browser. Empty (the default) allows any origin, which is safe here because the policy sends no credentials: the browser attaches no cookies cross-origin, and these endpoints authenticate through client credentials or bearer tokens carried in headers.
public System.Collections.Generic.IList<string> AllowedOrigins { get; }