I have a net framework 4.7.2 FE which I would like to consume a new netcore 5 webapi/signalR application.

At the moment I have both running on my machine with the FE in VS2017 under local IIS (https://local.redacted.com) and latter in VS2019 IIS Express and both are span up with the play/debug button.

I have installed cors nuget for netcore and have the following in my startup:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(c =>
            {
                c.AddPolicy(
                    "AllowCCORSOrigin",
                    options => options.WithOrigins("https://local.redacted.com/")
                        .AllowAnyMethod()
                        .AllowAnyHeader()
                        .AllowCredentials());
            });
        services.AddControllers();
        services.AddSingleton<KillChecker>();
        services.AddHttpContextAccessor();
        services.AddSignalR().AddMessagePackProtocol();
        services.AddSignalR(
            o =>
                {
                    o.EnableDetailedErrors = true;
                });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseFileServer(); //needed?
        app.UseStaticFiles();
        app.UseRouting();

        app.UseCors(builder =>
            {
                builder
                    .WithOrigins("https://local.redacted.com/")
                    .AllowAnyMethod()
                    .AllowAnyHeader()
                    .AllowCredentials();
            });
        
        app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
                endpoints.MapHub<KillHub>("/killhub");
            });
    }
}

I also decorated my Launch controller with:

[Route("[controller]"), EnableCors()]
public class LaunchController : Controller

From the FE application I am getting the following CORS error when running my JS:

const options = {
    method: "POST",
    body: JSON.stringify(params),
    headers: {
        'content-type': "application/json"
    }
};
fetch("https://localhost:60907/Launch", options)
    .then(response => response.json())
    .then(data => console.log(data))
    .then(console.log('lift off'));

Access to fetch at 'https://localhost:60907/Launch' from origin 'https://local.redacted.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.