From 4199fa23d613bc4d3ff48bbb9d53f0ca1eae4b81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Chalet?= <kevinchalet@gmail.com>
Date: Wed, 9 Mar 2016 14:50:39 +0100
Subject: [PATCH] Remove CORS from the default modules list

---
 src/OpenIddict.Security/OpenIddictExtensions.cs | 16 +++++++++-------
 src/OpenIddict/OpenIddictExtensions.cs          |  1 -
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/OpenIddict.Security/OpenIddictExtensions.cs b/src/OpenIddict.Security/OpenIddictExtensions.cs
index d1199240..95b782f6 100644
--- a/src/OpenIddict.Security/OpenIddictExtensions.cs
+++ b/src/OpenIddict.Security/OpenIddictExtensions.cs
@@ -1,5 +1,6 @@
 using System;
 using JetBrains.Annotations;
+using Microsoft.AspNetCore.Cors.Infrastructure;
 using NWebsec.Middleware;
 
 namespace Microsoft.AspNetCore.Builder {
@@ -47,17 +48,18 @@ namespace Microsoft.AspNetCore.Builder {
             });
         }
 
-        public static OpenIddictBuilder UseCors([NotNull] this OpenIddictBuilder builder) {
+        public static OpenIddictBuilder UseCors(
+            [NotNull] this OpenIddictBuilder builder,
+            [NotNull] Action<CorsPolicyBuilder> configuration) {
             if (builder == null) {
                 throw new ArgumentNullException(nameof(builder));
             }
 
-            builder.AddModule("CORS", -10, map => map.UseCors(options => {
-                options.AllowAnyHeader();
-                options.AllowAnyMethod();
-                options.AllowAnyOrigin();
-                options.AllowCredentials();
-            }));
+            if (configuration == null) {
+                throw new ArgumentNullException(nameof(configuration));
+            }
+
+            builder.AddModule("CORS", -10, map => map.UseCors(configuration));
 
             return builder;
         }
diff --git a/src/OpenIddict/OpenIddictExtensions.cs b/src/OpenIddict/OpenIddictExtensions.cs
index 4dff0ac5..5e93515d 100644
--- a/src/OpenIddict/OpenIddictExtensions.cs
+++ b/src/OpenIddict/OpenIddictExtensions.cs
@@ -51,7 +51,6 @@ namespace Microsoft.AspNetCore.Builder {
 
             return app.UseOpenIddictCore(builder => {
                 builder.UseAssets();
-                builder.UseCors();
                 builder.UseNWebsec();
                 builder.UseMvc();