ASP.NET Web API Security Essentials

Setting the allowed HTTP methods

We can also restrict the HTTP methods in CORS. This can be achieved by supplying a comma separated list of HTTP methods that are allowed to the [EnableCors] attribute's methods parameter as given in the following:

[EnableCors(origins: "http://localhost:53870", headers: "*", methods: "get,post")] public class ContactsController : ApiController { IEnumerable<Contact> contacts = new List<Contact> { new Contact { Id = 1, Name = "Steve", Email = "[e-mail]", Mobile = "[phone]" }, new Contact { Id = 2, Name = "Matt", Email = "[e-mail]", Mobile = "[phone]" }, new Contact { Id = 3, Name = "Mark", Email = "[e-mail]", Mobile = "[phone]" } }; // GET: api/Contacts public IEnumerable<Contact> ...