Cross Origin Resource Sharing (CORS) allows cross origin apps to access the application. In case of web API, it's a faceless application that receives a request and returns a response; however, when this web API is consumed in another web application (using AJAX in JavaScript to call APIs), the client would be on a different domain.
Consider an example, the web API is hosted as www.packtdemo.com/api and the web application is hosted as www.packtdemoweb.com. When the web app calls, the API responds with No Access-Control-Allow-Origin header is present on the requested resource. This means your domain is not allowed to access API resources.
This CORS concept can also be used to limit any unwanted web applications to access the web API. The idea behind this is to add the CORS policy in ASP.NET Core Startup processing and apply them either globally or as per controller.
...
