Fix CORS configuration error - wildcard origins with credentials

Fixed InvalidOperationException: CORS protocol does not allow wildcard origins with credentials
- Updated CORS policy to handle wildcard vs specific origins properly
- Wildcard origins: AllowAnyOrigin() without credentials
- Specific origins: WithOrigins() with credentials enabled
- Added logging to show which CORS policy is being used
- Updated Docker and Production configs with specific origins
- Application should now start successfully in Docker containers

Author: Dang

VehicleShowroomManagement/src/WebAPI/Program.cs

@@ -178,10 +178,27 @@
 {
     options.AddPolicy("AllowFE", policy =>
     {
-        policy.WithOrigins(builder.Configuration["Cors:Origins"]?.Split(';', StringSplitOptions.RemoveEmptyEntries) ?? ["http://localhost:3000"])
-              .AllowAnyMethod()
-              .AllowAnyHeader()
-              .AllowCredentials();
+        var origins = builder.Configuration["Cors:Origins"]?.Split(';', StringSplitOptions.RemoveEmptyEntries) ?? ["http://localhost:3000"];
+        
+        Log.Information("CORS Origins configured: {Origins}", string.Join(", ", origins));
+        
+        if (origins.Contains("*"))
+        {
+            // For wildcard origins, don't allow credentials
+            Log.Information("Using wildcard CORS policy (no credentials)");
+            policy.AllowAnyOrigin()
+                  .AllowAnyMethod()
+                  .AllowAnyHeader();
+        }
+        else
+        {
+            // For specific origins, allow credentials
+            Log.Information("Using specific origins CORS policy (with credentials)");
+            policy.WithOrigins(origins)
+                  .AllowAnyMethod()
+                  .AllowAnyHeader()
+                  .AllowCredentials();
+        }
     });
 });
 

VehicleShowroomManagement/src/WebAPI/appsettings.Docker.json

@@ -16,7 +16,7 @@
     }
   },
   "Cors": {
-    "Origins": "*"
+    "Origins": "http://localhost:3000;http://localhost:3001;http://localhost:8080;http://localhost:8081"
   },
   "Kestrel": {
     "Endpoints": {

VehicleShowroomManagement/src/WebAPI/appsettings.Production.json

@@ -15,6 +15,6 @@
     }
   },
   "Cors": {
-    "Origins": "*"
+    "Origins": "https://yourdomain.com;https://www.yourdomain.com"
   }
 }