# View Reports from Different Domains using CORS

Explore the essentials of Cross-Origin Resource Sharing (CORS), a web technology that facilitates asynchronous operations and access to reports from various domains.

## Content

Cross-Origin Resource Sharing is a technology for the web that provides async web operations to directly access reports from different domains. CORS works by adding a special header to responses from a server to the client. If a response contains the Access-Control-Allow-Origin header, then you can directly access the reports from another domain.

![Cross-Origin Resource Sharing](https://cdn.mescius.io/document-site-files/images/b298aea2-8cb8-4a0f-be88-4f54aa263ebd/images/difdomain_cors.png)

The following viewers require CORS:

1. Js Viewer
2. HTMLViewer (WebViewer control)
3. RawHTML (WebViewer control)

## .NET Framework

If Server is an ASP.NET application, then following markup should be added to the web.config file:

```xml
<customHeaders>
     <add name="Access-Control-Allow-Origin" value="http://localhost:44362" />
     <add name="Access-Control-Allow-Methods" value="GET, POST, OPTIONS" />
     <add name="Access-Control-Allow-Credentials" value="true"/>
     <add name="Access-Control-Allow-Headers" value="pragma,cache-control,expires,content-type"/>
     <add name="Access-Control-Expose-Headers" value="Content-Disposition"/>
 </customHeaders>
```

Replace the link ```http://localhost:44362``` with the actual client url.

## .NET Core

If Server is an ASP.NET Core application,

1\. Add the following code to the **Startup.ConfigureServices** method in **Startup.cs** file:

```csharp
public void ConfigureServices(IServiceCollection services)
{
    services
        .AddLogging(config =>
        {
            config.ClearProviders();
            if (Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT") == Environments.Development)
            {
                config.AddConsole();
            }
        })
        .AddCors(options =>
        {
            options.AddPolicy("AllowAll", builder =>
            {
                builder.SetIsOriginAllowed(origin => new Uri(origin).Host == "XXXX")
                .AllowCredentials()
                .AllowAnyMethod()
                .AllowAnyHeader()
                .WithExposedHeaders("Content-Disposition");
            });
        })
        .AddReportViewer()
        .AddMvc(option => option.EnableEndpointRouting = false);
}
```

2\. Add the following code to the **Startup.Configure** method in **Startup.cs** file:

```csharp
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    app.UseCors("AllowAll");
    app.UseReportViewer(settings =>
    {
        settings.UseEmbeddedTemplates(EmbeddedReportsPrefix, Assembly.GetAssembly(app.GetType()));
        settings.UseCompression = true;
    });
    app.UseMvc();
}
```

> type=note
> Note: If you get error 404 or 500 on the report preview, please make sure that your browser supports CORS.