C# 从源站访问XMLHttpRequest'；http://localhost:4200' 已被CORS策略阻止（Angular、WebApi）

我想这个错误在这里是众所周知的。。。 我以前在当前项目中遇到过这个错误，当我试图修复它时，他们说我缺少EnableCors的权限，尽管它明确表示有（请参见项目中的下文）。最后的问题是属性的位置，我必须先把它放在RoutePrefix的属性后面。而且效果很好。 现在我做了另一个函数，当我试图运行它时，这个错误再次出现。 我已经测试了很多解决这个问题的方法，但是我对所有这些都很陌生，我很难理解我应该在哪里写什么。。。 我在想，也许这和我写的新函数有关？可能是出了什么问题。新函数是GetProductivityRequest

这是一个WebApi项目

这就是我的代码：

UserController.cs

using BL;
using DTO;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
using System.Web.Http.Cors;

namespace WebApiSystem.Controllers
{
    //at first, the atributs looks like this:
    //[RoutePrefix("api/User")]
    //[EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*", SupportsCredentials = true)]
    //When I changed the position as you can see, the problem was solved.

    [EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*", SupportsCredentials = true)]
    [RoutePrefix("api/User")]

    public class UserController : ApiController
    {

        [HttpGet]
        [Route("login/{email}/{pass}")]

        public IHttpActionResult LogIn(string email, string pass)
        {
            UserDTO user = BL.UserService.LogIn(email, pass);
            if (user != null)
                return Ok(user);
            return NotFound();
        }

        [Route("register")]
        public IHttpActionResult Register(UserDTO user)
        {

            return NotFound();
        }
        [HttpPost]
        [Route("productivity")]

        public IHttpActionResult InsertProductivity([FromBody] ProductivityDTO p)
        {
            bool b = BL.UserService.InsertProductivity(p);
            if (b)
                return Ok(b);
            return BadRequest();
        }

        [HttpGet]
        [Route("getProductivityRequest")]     //This is the function that brought back my problem
        public IHttpActionResult GetProductivityRequest()
        {
            return Ok(UserService.GetProductivityRequest());
        }

    }
}

using DAL;
using DTO;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace BL
{
    public class UserService
    {
        public static UserDTO LogIn(string email, string pass)
        {
            using (Model2 db = new Model2())
            {
                UserTbl user = db.UserTbl.FirstOrDefault(u => u.UserEmail == email && u.UserPassLogin == pass);
                if (user == null)
                    return null;
                return CONVERTERS.UserConverter.ConvertUsertoDTO(user);
            }
        }

        public static bool InsertProductivity(ProductivityDTO p)
        {
            using (Model2 db = new Model2())
            {                   
                ProductivityTbl prod = BL.CONVERTERS.ProductivityConverter.ProductivityDal(p);
                prod.ProductivityStatus = 1;
                db.ProductivityTbl.Add(prod);
                db.SaveChanges();
                return true;
            }
            return false;
        }

//This is the function that brought back my problem
        public static IQueryable<dynamic> GetProductivityRequest()
        {
            using (Model2 db = new Model2())
            {
                db.Configuration.ProxyCreationEnabled = false;
                db.Configuration.LazyLoadingEnabled = false;
                IQueryable<dynamic> PList = db.ProductivityTbl.Select(p=> new { ProductivityStatus= 1 });
                return PList;
            }
        }
    }
}

UserService.cs

using BL;
using DTO;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
using System.Web.Http.Cors;

namespace WebApiSystem.Controllers
{
    //at first, the atributs looks like this:
    //[RoutePrefix("api/User")]
    //[EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*", SupportsCredentials = true)]
    //When I changed the position as you can see, the problem was solved.

    [EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*", SupportsCredentials = true)]
    [RoutePrefix("api/User")]

    public class UserController : ApiController
    {

        [HttpGet]
        [Route("login/{email}/{pass}")]

        public IHttpActionResult LogIn(string email, string pass)
        {
            UserDTO user = BL.UserService.LogIn(email, pass);
            if (user != null)
                return Ok(user);
            return NotFound();
        }

        [Route("register")]
        public IHttpActionResult Register(UserDTO user)
        {

            return NotFound();
        }
        [HttpPost]
        [Route("productivity")]

        public IHttpActionResult InsertProductivity([FromBody] ProductivityDTO p)
        {
            bool b = BL.UserService.InsertProductivity(p);
            if (b)
                return Ok(b);
            return BadRequest();
        }

        [HttpGet]
        [Route("getProductivityRequest")]     //This is the function that brought back my problem
        public IHttpActionResult GetProductivityRequest()
        {
            return Ok(UserService.GetProductivityRequest());
        }

    }
}

using DAL;
using DTO;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace BL
{
    public class UserService
    {
        public static UserDTO LogIn(string email, string pass)
        {
            using (Model2 db = new Model2())
            {
                UserTbl user = db.UserTbl.FirstOrDefault(u => u.UserEmail == email && u.UserPassLogin == pass);
                if (user == null)
                    return null;
                return CONVERTERS.UserConverter.ConvertUsertoDTO(user);
            }
        }

        public static bool InsertProductivity(ProductivityDTO p)
        {
            using (Model2 db = new Model2())
            {                   
                ProductivityTbl prod = BL.CONVERTERS.ProductivityConverter.ProductivityDal(p);
                prod.ProductivityStatus = 1;
                db.ProductivityTbl.Add(prod);
                db.SaveChanges();
                return true;
            }
            return false;
        }

//This is the function that brought back my problem
        public static IQueryable<dynamic> GetProductivityRequest()
        {
            using (Model2 db = new Model2())
            {
                db.Configuration.ProxyCreationEnabled = false;
                db.Configuration.LazyLoadingEnabled = false;
                IQueryable<dynamic> PList = db.ProductivityTbl.Select(p=> new { ProductivityStatus= 1 });
                return PList;
            }
        }
    }
}

我仍然认为问题可能是因为我编写的新函数。如果你能看一下，也许我在那里写错了什么，这会对我有很大帮助。

---

谢谢大家!

我不知道为什么会被否决，这对我来说似乎是一个非常好的问题，你是对的，关于CORS，在堆栈和其他地方有很多。我不是CORS方面的专家，但您的浏览器正在阻止您的访问，因为它怀疑XSS攻击

要测试API是否正常工作，可以使用浏览器插件伪造CORS头。这是一个谷歌浏览器

这对于测试来说没问题，但是对于更持久的修复，您可以告诉您的.NET core应用程序发送正确的头以允许数据被接受

在ConfigureServices方法的startup类中，定义要应用的CORS策略。像这样的

        services.AddCors(options =>
        {
            options.AddPolicy("AllRequests", builder =>
            {
                builder
                .WithOrigins("http://localhost:4200", "https://livesite.com")
                .AllowAnyHeader()
                .AllowAnyMethod()
                .AllowCredentials();
            });
        });

然后在Configure方法中，在管道中调用它

        app.UseCors("AllRequests");

微软的文章（在上面的链接中）很好地解释了这一点

所以你有50%在那里。祝你好运