Configuration CORS Policy Provider

ConfigCorsPolicyProvider.cs

public class ConfigCorsPolicyProvider : ICorsPolicyProvider
{
    private readonly IConfigurationService configurationService;

    public ConfigCorsPolicyProvider(IConfigurationService configurationService)
    {
        this.configurationService = configurationService;
    }

    public Task<CorsPolicy> GetCorsPolicyAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var allowedOrigins = configurationService.GetAppSetting("security.AllowedOrigins");
        if (string.IsNullOrWhiteSpace(allowedOrigins))
        {
            var allowAllPolicy = new CorsPolicy
            {
                AllowAnyHeader = true,
                AllowAnyMethod = true,
                AllowAnyOrigin = false,
                SupportsCredentials = true
            };

            return Task.FromResult(allowAllPolicy);
        }

        var origins = allowedOrigins
            .Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries)
            .Select(origin => origin.Trim())
            .ToArray();

        var policy = new CorsPolicy
        {
            AllowAnyHeader = true,
            AllowAnyMethod = true,
            AllowAnyOrigin = false,
            SupportsCredentials = true
        };

        foreach (var origin in origins)
        {
            policy.Origins.Add(origin);
        }

        return Task.FromResult(policy);
    }
}