#### [Abblix\.Oidc\.Server\.AspNetCore](https://www.abblix.com/en/docs/api/abblix-oidc-server-aspnetcore 'index')
### [Abblix\.Oidc\.Server\.AspNetCore](https://www.abblix.com/en/docs/api/abblix-oidc-server-aspnetcore/Abblix.Oidc.Server.AspNetCore 'Abblix\.Oidc\.Server\.AspNetCore')

## OidcCorsOptions Class

Host\-configurable inputs for the default CORS policy \([CorsPolicyName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.OidcConstants#Abblix.Oidc.Server.Common.Constants.OidcConstants.CorsPolicyName 'Abblix\.Oidc\.Server\.Common\.Constants\.OidcConstants\.CorsPolicyName')\) that the
MVC and Minimal API adapters register for the OIDC endpoints\.

```csharp
public sealed class OidcCorsOptions
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OidcCorsOptions

### Remarks
A host controls the policy at two levels, and both are honoured whether one adapter is used or both:
- <b>Supplement</b> the default by configuring this type, e.g.
              `services.Configure<OidcCorsOptions>(o => o.AllowedOrigins.Add("https://spa.example.com"))`.
              Both adapters build the default policy from the same options, so the restriction applies uniformly.
- <b>Override</b> the default entirely by registering a CORS policy named
              [CorsPolicyName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.OidcConstants#Abblix.Oidc.Server.Common.Constants.OidcConstants.CorsPolicyName 'Abblix\.Oidc\.Server\.Common\.Constants\.OidcConstants\.CorsPolicyName'), e.g. `services.AddCors(o => o.AddPolicy(...))`. A
              host-defined policy of that name always wins, in any registration order, because the adapters fill the
              default only when the host has not defined one.
### Properties

## OidcCorsOptions\.AllowedOrigins Property {#Abblix.Oidc.Server.AspNetCore.OidcCorsOptions.AllowedOrigins}

Origins allowed to read the OIDC endpoints from a browser\. Empty \(the default\) allows any origin, which
is safe here because the policy sends no credentials: the browser attaches no cookies cross\-origin, and
these endpoints authenticate through client credentials or bearer tokens carried in headers\.

```csharp
public System.Collections.Generic.IList<string> AllowedOrigins { get; }
```

#### Property Value
[System\.Collections\.Generic\.IList&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')