{"id":983,"date":"2026-10-27T19:01:13","date_gmt":"2026-10-27T10:01:13","guid":{"rendered":"https:\/\/csharp.ihavenomoney.co.kr\/?p=983"},"modified":"2026-10-27T20:11:10","modified_gmt":"2026-10-27T11:11:10","slug":"%ec%9b%b9-%ec%98%a4%eb%a6%ac%ec%a7%84origin-%ec%99%84%eb%b2%bd-%ec%9d%b4%ed%95%b4-same-origin-policy-cors-javascript%ec%99%80-asp-net-core-%ec%98%88%ec%a0%9c","status":"publish","type":"post","link":"https:\/\/csharp.ihavenomoney.co.kr\/?p=983","title":{"rendered":"\uc6f9 \uc624\ub9ac\uc9c4(Origin) \uc644\ubcbd \uc774\ud574: Same-Origin Policy, CORS, JavaScript\uc640 ASP.NET Core \uc608\uc81c"},"content":{"rendered":"\n

\uc624\ub9ac\uc9c4(Origin)\uc740 \uc6f9 \ube0c\ub77c\uc6b0\uc800\uac00 \ub9ac\uc18c\uc2a4\uc758 \ucd9c\ucc98\ub97c \uad6c\ubcc4\ud558\ub294 \ud575\uc2ec \ubcf4\uc548 \uac1c\ub150\uc785\ub2c8\ub2e4.<\/strong> \uc77c\ubc18\uc801\uc778 HTTP(S) URL\uc5d0\uc11c \uc624\ub9ac\uc9c4\uc740 \uc2a4\ud0b4(Scheme) + \ud638\uc2a4\ud2b8(Host) + \ud3ec\ud2b8(Port)<\/strong>\ub85c \uacb0\uc815\ub429\ub2c8\ub2e4. \uc774 \uae00\uc5d0\uc11c\ub294 \uc815\uc758\ubd80\ud130 Same-Origin Policy, CORS, JavaScript, ASP.NET Core \ubc0f WordPress \uc5f0\ub3d9\uae4c\uc9c0 \uc2e4\uc81c \ucf54\ub4dc\ub85c \uc124\uba85\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

1. URL\uacfc Origin\uc758 \ucc28\uc774<\/h2>\n\n\n\n
https://csharp.ihavenomoney.co.kr:443\/tutorial?id=10#intro\n\u2514https\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\ud638\uc2a4\ud2b8\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\ud3ec\ud2b8\u2518 \u2514\uacbd\ub85c\/\ucffc\ub9ac\/\ud504\ub798\uadf8\uba3c\ud2b8\u2518<\/code><\/pre>\n\n\n\n
\uc774 URL\uc758 \uc624\ub9ac\uc9c4\uc740 https:\/\/csharp.ihavenomoney.co.kr<\/code>\uc785\ub2c8\ub2e4. HTTPS \uae30\ubcf8 \ud3ec\ud2b8 443\uc740 \ud45c\uc2dc\uc5d0\uc11c \uc0dd\ub7b5\ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4. HTTP \uae30\ubcf8 \ud3ec\ud2b8\ub294 80\uc785\ub2c8\ub2e4. \uacbd\ub85c, \ucffc\ub9ac \ubb38\uc790\uc5f4, \ud504\ub798\uadf8\uba3c\ud2b8, \uc0ac\uc6a9\uc790 \uc815\ubcf4\ub294 \uc624\ub9ac\uc9c4\uc5d0 \ud3ec\ud568\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \uc5ec\uae30\uc11c ‘\ud504\ub85c\ud1a0\ucf5c’\ubcf4\ub2e4 URL \ud45c\uc900 \uc6a9\uc5b4\uc778 ‘\uc2a4\ud0b4’\uc774 \ub354 \uc815\ud655\ud558\uba70, \ud638\uc2a4\ud2b8\ub294 \ub3c4\uba54\uc778 \uc774\ub984\ubfd0 \uc544\ub2c8\ub77c IP \uc8fc\uc18c\uc77c \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
2. \ub3d9\uc77c \uc624\ub9ac\uc9c4 \ube44\uad50\ud45c<\/h2>\n\n\n\n
\uae30\uc900: https:\/\/csharp.ihavenomoney.co.kr<\/code><\/p>\n\n\n\n
\ube44\uad50 \uc8fc\uc18c<\/th>\ub3d9\uc77c \uc624\ub9ac\uc9c4?<\/th>\uc774\uc720<\/th><\/tr><\/thead>
https:\/\/csharp.ihavenomoney.co.kr\/post\/1<\/code><\/td>\uc608 <\/td>\uacbd\ub85c\ub9cc \ub2e4\ub984  (80, 443 \ub3d9\uc77c\ub85c \uac04\uc8fc)<\/td><\/tr>
https:\/\/csharp.ihavenomoney.co.kr:443<\/code><\/td>\uc608<\/td>\uae30\ubcf8 \ud3ec\ud2b8  (80, 443 \ub3d9\uc77c\ub85c \uac04\uc8fc)<\/td><\/tr>
http:\/\/csharp.ihavenomoney.co.kr<\/code><\/td>\uc544\ub2c8\uc694<\/td>\uc2a4\ud0b4 \ub2e4\ub984<\/td><\/tr>
https:\/\/ihavenomoney.co.kr<\/code><\/td>\uc544\ub2c8\uc694<\/td>\ud638\uc2a4\ud2b8 \ub2e4\ub984<\/td><\/tr>
https:\/\/csharp.ihavenomoney.co.kr:8443<\/code><\/td>\uc544\ub2c8\uc694<\/td>\ud3ec\ud2b8 \ub2e4\ub984<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\uac19\uc740 \uc11c\ubc84 IP\ub97c \uc0ac\uc6a9\ud558\uac70\ub098 \uac19\uc740 \uc0c1\uc704 \ub3c4\uba54\uc778\uc5d0 \uc18d\ud558\ub354\ub77c\ub3c4 \ubc18\ub4dc\uc2dc \uac19\uc740 \uc624\ub9ac\uc9c4\uc740 \uc544\ub2d9\ub2c8\ub2e4.<\/strong><\/p>\n\n\n\n
3. Same-Origin Policy(SOP)\ub780?<\/h2>\n\n\n\n
\ub3d9\uc77c \ucd9c\ucc98 \uc815\ucc45\uc740 \ud55c \ucd9c\ucc98\uc5d0\uc11c \uc2e4\ud589\ub41c \uc2a4\ud06c\ub9bd\ud2b8\uac00 \ub2e4\ub978 \ucd9c\ucc98\uc758 \ubbfc\uac10\ud55c \uc751\ub2f5 \ub370\uc774\ud130\ub098 DOM\uc5d0 \ubb34\uc81c\ud55c \uc811\uadfc\ud558\uc9c0 \ubabb\ud558\uac8c \ud558\ub294 \ube0c\ub77c\uc6b0\uc800 \ubcf4\uc548 \uaddc\uce59\uc785\ub2c8\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \uc545\uc131 \uc0ac\uc774\ud2b8\uac00 \uc0ac\uc6a9\uc790\uc758 \ub85c\uadf8\uc778 \uc138\uc158\uc744 \uc774\uc6a9\ud574 \ub2e4\ub978 \uc0ac\uc774\ud2b8\uc758 \uac1c\uc778\uc815\ubcf4\ub97c \ub9c8\uc74c\ub300\ub85c \uc77d\uc9c0 \ubabb\ud558\uac8c \uc81c\ud55c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
\ub2e8, \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad\uc774 \ubaa8\ub450 \uae08\uc9c0\ub418\ub294 \uac83\uc740 \uc544\ub2d9\ub2c8\ub2e4. \ub9c1\ud06c \uc774\ub3d9, \uc77c\ubd80 HTML \ud3fc \uc804\uc1a1, \uc774\ubbf8\uc9c0\u00b7\uc2a4\ud06c\ub9bd\ud2b8 \uc0bd\uc785 \ub4f1\uc740 \ubcc4\ub3c4 \uaddc\uce59\uc5d0 \ub530\ub77c \uac00\ub2a5\ud558\uba70, fetch()<\/code>\uc758 \uad50\ucc28 \ucd9c\ucc98 \uc751\ub2f5\uc744 JavaScript\uac00 \uc77d\ub294 \ud589\uc704\ub294 \uc77c\ubc18\uc801\uc73c\ub85c CORS \ud5c8\uac00\uac00 \ud544\uc694\ud569\ub2c8\ub2e4. CORS\ub294 \uc778\uc99d\uc774\ub098 CSRF \ubc29\uc5b4\ub97c \ub300\uc2e0\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
4. Origin HTTP \ud5e4\ub354\uc640 Referer\uc758 \ucc28\uc774<\/h2>\n\n\n\n
Origin: https:\/\/csharp.ihavenomoney.co.kr\nReferer: https:\/\/csharp.ihavenomoney.co.kr\/tutorial?id=10<\/code><\/pre>\n\n\n\n
Origin<\/code>\uc740 \uc694\uccad\uc744 \uc2dc\uc791\ud55c \ucd9c\ucc98\ub9cc \ud45c\ud604\ud558\uba70 \uacbd\ub85c\ub97c \ud3ec\ud568\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. Referer<\/code>\ub294 \ub9ac\ud37c\ub7ec \uc815\ucc45\uc5d0 \ub530\ub77c \uacbd\ub85c \ub4f1\uc758 \uc815\ubcf4\uac00 \ud3ec\ud568\ub418\uac70\ub098 \ucd95\uc18c\u00b7\uc0dd\ub7b5\ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ubaa8\ub4e0 \uc694\uccad\uc5d0 Origin \ud5e4\ub354\uac00 \ubc18\ub4dc\uc2dc \ud3ec\ud568\ub418\ub294 \uac83\uc740 \uc544\ub2c8\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub098 \ubd88\ud22c\uba85 \ucd9c\ucc98 \ub4f1\uc5d0\uc11c\ub294 Origin: null<\/code>\uc774 \ub098\ud0c0\ub0a0 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
5. CORS\ub294 \uc5b4\ub5bb\uac8c \uc791\ub3d9\ud558\ub098?<\/h2>\n\n\n\n
\ub2e4\ub978 \uc624\ub9ac\uc9c4\uc5d0\uc11c API\ub97c \ud638\ucd9c\ud560 \ub54c \ube0c\ub77c\uc6b0\uc800\ub294 \uc751\ub2f5\uc758 Access-Control-Allow-Origin<\/code> \ub4f1\uc744 \uac80\uc0ac\ud569\ub2c8\ub2e4. \uc11c\ubc84\uac00 \ud5c8\uc6a9\ud55c \ucd9c\ucc98\uc640 \uc77c\uce58\ud558\uba74 \ube0c\ub77c\uc6b0\uc800 JavaScript\uac00 \uc751\ub2f5\uc744 \uc77d\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
Access-Control-Allow-Origin: https:\/\/csharp.ihavenomoney.co.kr\nVary: Origin<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\uac00 \uc694\uccad Origin\uc5d0 \ub530\ub77c \ud5c8\uc6a9 \uac12\uc744 \ub3d9\uc801\uc73c\ub85c \ubc18\ud658\ud55c\ub2e4\uba74 \uce90\uc2dc \ud63c\ub3d9\uc744 \ud53c\ud558\uae30 \uc704\ud574 Vary: Origin<\/code>\uc744 \uace0\ub824\ud574\uc57c \ud569\ub2c8\ub2e4. \uacf5\uac1c \ub370\uc774\ud130\uc5d0\ub294 Access-Control-Allow-Origin: *<\/code>\uc774 \uac00\ub2a5\ud558\uc9c0\ub9cc, \ucfe0\ud0a4 \ub4f1 \uc790\uaca9 \uc99d\uba85\uc744 \ud3ec\ud568\ud558\ub294 \uc694\uccad\uc758 \uc751\ub2f5\uc5d0\ub294 \uc640\uc77c\ub4dc\uce74\ub4dc\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
Preflight(\uc0ac\uc804 \uc694\uccad)<\/h3>\n\n\n\n
\ud2b9\uc815 \uba54\uc11c\ub4dc \ub610\ub294 \ube44\ub2e8\uc21c \uc694\uccad \ud5e4\ub354\ub97c \uc0ac\uc6a9\ud558\uba74 \ube0c\ub77c\uc6b0\uc800\ub294 \uc2e4\uc81c \uc694\uccad\uc5d0 \uc55e\uc11c OPTIONS<\/code> \uc694\uccad\uc744 \ubcf4\ub0b4 \ud5c8\uc6a9 \uc5ec\ubd80\ub97c \ud655\uc778\ud569\ub2c8\ub2e4. \ubaa8\ub4e0 \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad\uc5d0 Preflight\uac00 \ubc1c\uc0dd\ud558\ub294 \uac83\uc740 \uc544\ub2d9\ub2c8\ub2e4.<\/p>\n\n\n\n
OPTIONS \/api\/items HTTP\/1.1\nOrigin: https:\/\/csharp.ihavenomoney.co.kr\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\ub294 \ud544\uc694\ud55c \uacbd\uc6b0 Access-Control-Allow-Methods<\/code>, Access-Control-Allow-Headers<\/code> \ub4f1\uc744 \ubc18\ud658\ud569\ub2c8\ub2e4. \uc774 \uac80\uc0ac\uac00 \ud1b5\uacfc\ud558\uba74 \ube0c\ub77c\uc6b0\uc800\uac00 \uc2e4\uc81c \uc694\uccad\uc744 \uc9c4\ud589\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
6. JavaScript\uc5d0\uc11c \ud604\uc7ac Origin \ud655\uc778<\/h2>\n\n\n\n
console.log(window.location.origin);\n\/\/ \uc608: https:\/\/csharp.ihavenomoney.co.kr\n\nconst target = new URL('https:\/\/ihavenomoney.co.kr\/wp-json\/wp\/v2\/posts');\nconsole.log(target.origin);\nconsole.log(target.origin === window.location.origin); \/\/ false<\/code><\/pre>\n\n\n\n
URL.origin<\/code>\uc740 \ube0c\ub77c\uc6b0\uc800\uac00 \uc815\uaddc\ud654\ud55c \ucd9c\ucc98\ub97c \ud655\uc778\ud560 \ub54c \ud3b8\ub9ac\ud569\ub2c8\ub2e4. \ub2e8, file:<\/code>, data:<\/code> \ub4f1 \ud2b9\uc218 \uc2a4\ud0b4\uc740 \uc77c\ubc18\uc801\uc778 HTTP(S) \uc624\ub9ac\uc9c4\uacfc \ub2e4\ub974\uac8c \ucde8\uae09\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
7. JavaScript fetch() \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad<\/h2>\n\n\n\n
async function loadPosts() {\n  const response = await fetch('https:\/\/ihavenomoney.co.kr\/wp-json\/wp\/v2\/posts?per_page=3');\n  if (!response.ok) throw new Error('HTTP ' + response.status);\n  const posts = await response.json();\n  console.log(posts);\n}\nloadPosts().catch(console.error);<\/code><\/pre>\n\n\n\n
\uc704 \ucf54\ub4dc\ub294 \uc0ac\uc6a9 \uac00\ub2a5\ud55c API\uc758 \uc608\uc2dc\uc785\ub2c8\ub2e4. \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \uc2e4\uc81c \uc131\uacf5\ud558\ub294\uc9c0\ub294 \ub300\uc0c1 \uc11c\ubc84\uc758 CORS \uc751\ub2f5 \uc124\uc815\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9d1\ub2c8\ub2e4.<\/strong> JavaScript\uc5d0 Access-Control-Allow-Origin<\/code> \uc694\uccad \ud5e4\ub354\ub97c \uc784\uc758\ub85c \ub123\ub294\ub2e4\uace0 \ud574\uacb0\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \uc774 \ud5e4\ub354\ub294 \uc751\ub2f5 \uc11c\ubc84\uac00 \uc124\uc815\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
8. ASP.NET Core\uc5d0\uc11c CORS \uc124\uc815\ud558\uae30<\/h2>\n\n\n\n
ASP.NET Core\uc758 Program.cs<\/code>\uc5d0\uc11c \ud5c8\uc6a9\ud560 \ud504\ub7f0\ud2b8\uc5d4\ub4dc \ucd9c\ucc98\ub97c \uba85\uc2dc\uc801\uc73c\ub85c \ub4f1\ub85d\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
var builder = WebApplication.CreateBuilder(args);\n\nbuilder.Services.AddCors(options =>\n{\n    options.AddPolicy(\"Frontend\", policy =>\n        policy.WithOrigins(\"https:\/\/csharp.ihavenomoney.co.kr\")\n              .WithMethods(\"GET\", \"POST\")\n              .WithHeaders(\"Content-Type\", \"Authorization\"));\n});\n\nvar app = builder.Build();\n\napp.UseRouting();\napp.UseCors(\"Frontend\");\napp.UseAuthorization();\n\napp.MapGet(\"\/api\/hello\", () => new { message = \"Hello\" });\n\napp.Run();<\/code><\/pre>\n\n\n\n
\uc774 \uc608\uc81c\ub294 \ucd5c\uc18c API\ub97c \uac00\uc815\ud569\ub2c8\ub2e4. \uc2e4\uc81c \ud504\ub85c\uc81d\ud2b8\uc5d0\uc11c\ub294 \uc778\uc99d\u00b7\uc778\uac00 \ubc0f \uc5d4\ub4dc\ud3ec\uc778\ud2b8 \uc124\uc815\uc5d0 \ub9de\uac8c \ubbf8\ub4e4\uc6e8\uc5b4 \uc21c\uc11c\ub97c \uc870\uc815\ud574\uc57c \ud569\ub2c8\ub2e4. \ucfe0\ud0a4 \uc778\uc99d\uc774 \ud544\uc694\ud558\ub2e4\uba74 \uc2e0\ub8b0\ud560 \uc218 \uc788\ub294 \ud2b9\uc815 \uc624\ub9ac\uc9c4\ub9cc \uc9c0\uc815\ud558\uace0 AllowCredentials()<\/code>\ub97c \uac80\ud1a0\ud558\uba70, \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0\ub3c4 credentials: 'include'<\/code>\uac00 \ud544\uc694\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ucfe0\ud0a4\uc758 SameSite\u00b7Secure \uc18d\uc131\ub3c4 \ubcc4\ub3c4\ub85c \uac80\ud1a0\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
9. WordPress REST API\uc640 Origin<\/h2>\n\n\n\n
WordPress REST API\ub294 \ubcf4\ud1b5 \/wp-json\/wp\/v2\/<\/code> \uacbd\ub85c\ub97c \uc0ac\uc6a9\ud569\ub2c8\ub2e4. \ub2e4\ub978 \ud558\uc704 \ub3c4\uba54\uc778\uc5d0\uc11c WordPress API\ub97c \uc77d\uc73c\ub824\uba74 API \uc11c\ubc84\uc758 CORS \uc815\ucc45\uc744 \ud655\uc778\ud574\uc57c \ud569\ub2c8\ub2e4. \uacf5\uac1c \uae00 \uc870\ud68c\uc640 \ub85c\uadf8\uc778\ub41c \uc0ac\uc6a9\uc790\uc758 \uae00 \uc218\uc815\uc740 \ubcf4\uc548 \uc694\uad6c\uc0ac\ud56d\uc774 \ub2e4\ub985\ub2c8\ub2e4.<\/p>\n\n\n\n
    \n
  • \uacf5\uac1c \uae00 \uc870\ud68c: CORS \uc751\ub2f5\uacfc \uacf5\uac1c \uc811\uadfc \uac00\ub2a5 \uc5ec\ubd80 \ud655\uc778<\/li>\n\n\n\n
  • \uae00 \uc791\uc131\u00b7\uc218\uc815: WordPress \uc778\uc99d\uacfc \ud574\ub2f9 \uc0ac\uc6a9\uc790\uc758 \uad8c\ud55c \ud655\uc778<\/li>\n\n\n\n
  • \ucfe0\ud0a4 \uae30\ubc18 \uc778\uc99d: WordPress nonce, \ucfe0\ud0a4 \uc815\ucc45, CSRF \ubcf4\ud638 \ud655\uc778<\/li>\n\n\n\n
  • \uc11c\ubc84 \uac04 \uc694\uccad: \ube0c\ub77c\uc6b0\uc800 CORS \uc81c\ud55c\uacfc \ubcc4\uac1c\uc774\uba70 API \uc778\uc99d\uc740 \uc5ec\uc804\ud788 \ud544\uc694<\/li>\n<\/ul>\n\n\n\n
    WordPress \uc0ac\uc774\ud2b8\uc758 CORS\ub97c \ubb34\uc870\uac74 *<\/code>\ub85c \uc5f4\uac70\ub098 \ubaa8\ub4e0 \ucd9c\ucc98\uc5d0 \uc778\uc99d \uc694\uccad\uc744 \ud5c8\uc6a9\ud558\ub294 \uc124\uc815\uc740 \ud53c\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
    10. \uc790\uc8fc \ubc1c\uc0dd\ud558\ub294 CORS \uc624\ub958 \ud574\uacb0<\/h2>\n\n\n\n
    \uc99d\uc0c1<\/th>\ud655\uc778\ud560 \uc0ac\ud56d<\/th><\/tr><\/thead>
    No ‘Access-Control-Allow-Origin’ header<\/td>API \uc11c\ubc84\uc758 \uc751\ub2f5 \ud5e4\ub354\uc640 \ud5c8\uc6a9 \ucd9c\ucc98<\/td><\/tr>
    Preflight request doesn’t pass<\/td>OPTIONS \ucc98\ub9ac, \ud5c8\uc6a9 \uba54\uc11c\ub4dc\u00b7\ud5e4\ub354, \ub9ac\ub2e4\uc774\ub809\ud2b8<\/td><\/tr>
    Credential + wildcard \uc624\ub958<\/td>*<\/code> \ub300\uc2e0 \ud2b9\uc815 Origin \ubc0f \uc790\uaca9 \uc99d\uba85 \uc124\uc815<\/td><\/tr>
    HTTP\uc5d0\uc11c HTTPS \ud638\ucd9c \ubb38\uc81c<\/td>\uc2a4\ud0b4 \ucc28\uc774\uc640 \ud63c\ud569 \ucf58\ud150\uce20 \uc815\ucc45 \ud655\uc778<\/td><\/tr>
    401 \ub610\ub294 403 \uc751\ub2f5<\/td>CORS\ubfd0 \uc544\ub2c8\ub77c \uc778\uc99d\u00b7\uc778\uac00 \ubb38\uc81c \ud655\uc778<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Chrome\u00b7Edge \uac1c\ubc1c\uc790 \ub3c4\uad6c\uc758 Network<\/strong> \ud0ed\uc5d0\uc11c \uc2e4\uc81c \uc694\uccad, OPTIONS \uc694\uccad, \uc751\ub2f5 \ud5e4\ub354, \uc0c1\ud0dc \ucf54\ub4dc\ub97c \uba3c\uc800 \ud655\uc778\ud558\uc138\uc694. \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c CORS\ub97c \ube44\ud65c\uc131\ud654\ud558\ub294 \ubc29\uc2dd\uc740 \uc6b4\uc601 \ud658\uacbd\uc758 \ud574\uacb0\ucc45\uc774 \uc544\ub2d9\ub2c8\ub2e4.<\/p>\n\n\n\n
    11. Origin\uacfc Site\ub294 \ub2e4\ub974\ub2e4<\/h2>\n\n\n\n
    Origin\uc740 \uc2a4\ud0b4\u00b7\ud638\uc2a4\ud2b8\u00b7\ud3ec\ud2b8 \uae30\uc900\uc774\uace0, SameSite \ucfe0\ud0a4 \uc815\ucc45\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 ‘site’\ub294 \uc77c\ubc18\uc801\uc73c\ub85c \uc2a4\ud0b4\uacfc \ub4f1\ub85d \uac00\ub2a5\ud55c \ub3c4\uba54\uc778 \uae30\uc900\uc785\ub2c8\ub2e4. \ub530\ub77c\uc11c https:\/\/a.example.com<\/code>\uacfc https:\/\/b.example.com<\/code>\uc740 \uc11c\ub85c \ub2e4\ub978 Origin\uc774\uc9c0\ub9cc \ub3d9\uc77c\ud55c site\ub85c \ucde8\uae09\ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4. SameSite \ucfe0\ud0a4 \uc124\uc815\uacfc CORS \ud5c8\uc6a9 \uc5ec\ubd80\ub294 \uc11c\ub85c \ub2e4\ub978 \ubb38\uc81c<\/strong>\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
    \uc774 \uacbd\uc6b0 \ud504\ub860\ud2b8\uc5d4\ub4dc\uc5d0\uc11c API\ub97c \ud638\ucd9c\ud558\uba74 \ub2e4\ub978 \uc624\ub9ac\uc9c4\uc774\ub77c \ube0c\ub77c\uc6b0\uc800\uac00 \ub9c9\uc2b5\ub2c8\ub2e4. \uc774\ub54c \uc11c\ubc84\uac00 “\uc774 \uc624\ub9ac\uc9c4\uc740 \ub0b4\uac00 \ud5c8\uc6a9\ud55c\ub2e4”\uace0 \uc54c\ub824 \uc8fc\ub294 \uaddc\uce59\uc774 CORS(Cross-Origin Resource Sharing)<\/strong> \uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
    \uadf8\ub798\uc11c \ucf54\ub4dc\uc758 \uc774 \ubd80\ubd84\uc740<\/p>\n\n\n\n
    csharp<\/p>\n\n\n\n
    policy.WithOrigins(frontPageOrigins)<\/code><\/pre>\n\n\n\n
    “\uc5b4\ub5a4 \ud504\ub860\ud2b8\uc5d4\ub4dc \uc8fc\uc18c(\uc624\ub9ac\uc9c4)\uc5d0\uc11c \uc624\ub294 \uc694\uccad\uc744 \ud5c8\uc6a9\ud560\uc9c0”\ub97c \uc801\ub294 \ubaa9\ub85d\uc785\ub2c8\ub2e4. \uc124\uc815\uc5d0 \ub123\uc744 \ub54c\ub294 \uacbd\ub85c \uc5c6\uc774 \uc624\ub9ac\uc9c4 \ud615\ud0dc\ub85c \uc801\uc5b4\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
    json<\/p>\n\n\n\n
    \"AllowedOrigins\": [\n  \"http:\/\/localhost:3000\",       \/\/ O \uc62c\ubc14\ub984\n  \"https:\/\/myfront.example.com\"  \/\/ O \uc62c\ubc14\ub984\n]<\/code><\/pre>\n\n\n\n
    \"AllowedHosts\": \"*\"<\/code> \ub780?<\/h2>\n\n\n\n
    appsettings.json<\/code>\uc5d0 \uae30\ubcf8\uc73c\ub85c \ub4e4\uc5b4 \uc788\ub294 \uc124\uc815\uc774\uba70, \uc694\uccad\uc758 Host<\/code> \ud5e4\ub354\uac00 \uc5b4\ub5a4 \uac12\uc774\uc5b4\ub3c4 \ud5c8\uc6a9\ud55c\ub2e4<\/strong>\ub294 \ub73b\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
    json<\/p>\n\n\n\n
    {\n  \"AllowedHosts\": \"*\"\n}<\/code><\/pre>\n\n\n\n
    \ub3d9\uc791 \ubc29\uc2dd<\/h3>\n\n\n\n
    ASP.NET Core\uc5d0\ub294 Host Filtering \ubbf8\ub4e4\uc6e8\uc5b4<\/strong>\uac00 \uc788\uc2b5\ub2c8\ub2e4. \uc694\uccad\uc774 \ub4e4\uc5b4\uc624\uba74 HTTP Host<\/code> \ud5e4\ub354(\uc608: api.example.com<\/code>)\ub97c \ud655\uc778\ud574\uc11c, AllowedHosts<\/code>\uc5d0 \uc801\ud78c \ubaa9\ub85d\uc5d0 \uc5c6\uc73c\uba74 400 Bad Request<\/strong>\ub85c \uac70\ubd80\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
    \uc124\uc815\uac12<\/th>\uc758\ubbf8<\/th><\/tr><\/thead>
    \"*\"<\/code><\/td>\ubaa8\ub4e0 \ud638\uc2a4\ud2b8 \ud5c8\uc6a9 (\ud544\ud130\ub9c1 \uc548 \ud568)<\/td><\/tr>
    \"api.example.com\"<\/code><\/td>\uc774 \ud638\uc2a4\ud2b8\ub85c \uc628 \uc694\uccad\ub9cc \ud5c8\uc6a9<\/td><\/tr>
    \"api.example.com;admin.example.com\"<\/code><\/td>\uc138\ubbf8\ucf5c\ub860\uc73c\ub85c \uc5ec\ub7ec \uac1c \uc9c0\uc815<\/td><\/tr>
    \"*.example.com\"<\/code><\/td>\uc11c\ube0c\ub3c4\uba54\uc778 \uc640\uc77c\ub4dc\uce74\ub4dc<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    CORS\uc758 \uc624\ub9ac\uc9c4\uacfc \ubb50\uac00 \ub2e4\ub978\uac00<\/h3>\n\n\n\n
    \ud5f7\uac08\ub9ac\uae30 \uc26c\uc6b4\ub370 \uc11c\ub85c \uc644\uc804\ud788 \ub2e4\ub978 \uc124\uc815<\/strong>\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
    <\/th>AllowedHosts<\/code><\/th>Cors:AllowedOrigins<\/code><\/th><\/tr><\/thead>
    \ud655\uc778 \ub300\uc0c1<\/td>\uc694\uccad\uc758 Host<\/code> \ud5e4\ub354 (\ub0b4 \uc11c\ubc84\uc758 \uc8fc\uc18c<\/strong>)<\/td>\uc694\uccad\uc744 \ubcf4\ub0b8 \ud504\ub860\ud2b8\uc5d4\ub4dc\uc758 \uc624\ub9ac\uc9c4<\/strong><\/td><\/tr>
    \uc9c8\ubb38<\/td>“\uc774 \uc11c\ubc84 \uc8fc\uc18c\ub85c \ubd80\ub978 \uac8c \ub9de\ub098?”<\/td>“\uc774 \uc0ac\uc774\ud2b8\uc5d0\uc11c \ubd80\ub974\ub294 \uac78 \ud5c8\uc6a9\ud560\uae4c?”<\/td><\/tr>
    \ucc28\ub2e8 \ubc29\uc2dd<\/td>\uc11c\ubc84\uac00 400 \ubc18\ud658<\/td>\ube0c\ub77c\uc6b0\uc800\uac00 \uc751\ub2f5\uc744 \ub9c9\uc74c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \uc608\ub97c \ub4e4\uc5b4 \ud504\ub860\ud2b8\uc5d4\ub4dc https:\/\/myfront.example.com<\/code>\uc774 API https:\/\/api.example.com<\/code>\uc744 \ud638\ucd9c\ud558\uba74:<\/p>\n\n\n\n
      \n
    • AllowedHosts<\/code>\ub294 api.example.com<\/code><\/strong> (\uc11c\ubc84 \ucabd \uc8fc\uc18c)\uc744 \ubd05\ub2c8\ub2e4.<\/li>\n\n\n\n
    • AllowedOrigins<\/code>\ub294 https:\/\/myfront.example.com<\/code><\/strong> (\ud638\ucd9c\ud55c \ucabd \uc8fc\uc18c)\uc744 \ubd05\ub2c8\ub2e4.<\/li>\n<\/ul>\n\n\n\n
      \"*\"<\/code>\ub294 \uc548\uc804\ud55c\uac00?<\/h3>\n\n\n\n
      \uac1c\ubc1c \uc911\uc5d0\ub294 \ubb38\uc81c\uc5c6\uace0 \uae30\ubcf8\uac12\uc774\ub77c \ub300\ubd80\ubd84 \uadf8\ub300\ub85c \ub461\ub2c8\ub2e4. \ub2e4\ub9cc \uc6b4\uc601 \ud658\uacbd\uc5d0\uc11c\ub294 \uc2e4\uc81c \uc11c\ube44\uc2a4 \ub3c4\uba54\uc778\uc73c\ub85c \uc81c\ud55c\ud558\ub294 \uac83\uc774 \uad8c\uc7a5\ub429\ub2c8\ub2e4. Host<\/code> \ud5e4\ub354\ub97c \uc870\uc791\ud55c \uc694\uccad(Host Header Injection)\uc73c\ub85c \ube44\ubc00\ubc88\ud638 \uc7ac\uc124\uc815 \ub9c1\ud06c \uac19\uc740 \uc808\ub300 URL \uc0dd\uc131\uc774 \uc624\uc5fc\ub418\ub294 \uacf5\uaca9\uc744 \uc904\uc77c \uc218 \uc788\uae30 \ub54c\ubb38\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
      json<\/p>\n\n\n\n
      \"AllowedHosts\": \"api.example.com\"<\/code><\/pre>\n\n\n\n
      \ub2e4\ub9cc \ubcf4\ud1b5 \uc55e\ub2e8\uc5d0 \ub9ac\ubc84\uc2a4 \ud504\ub85d\uc2dc\ub098 \ub85c\ub4dc\ubc38\ub7f0\uc11c\uac00 Host\ub97c \uac80\uc99d\ud574 \uc8fc\ub294 \uad6c\uc131\uc774\ub77c\uba74 \"*\"<\/code>\ub85c \ub450\uc5b4\ub3c4 \uc2e4\uc9c8\uc801 \uc704\ud5d8\uc740 \uc791\uc2b5\ub2c8\ub2e4. \uc774 \ud504\ub85c\uc81d\ud2b8\ucc98\ub7fc URL\uc744 \ub9cc\ub4e4\uc5b4 \ub0b4\ubcf4\ub0b4\ub294 \ub85c\uc9c1\uc774 \uc5c6\ub294 API \uc11c\ubc84\ub294 \ub354\uc6b1 \uadf8\ub807\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
      <\/p>\n\n\n\n
      AllowedOrigins<\/code>\uac00 appsettings.json<\/code>\uc5d0 \uc5c6\uc73c\uba74?<\/h2>\n\n\n\n
      \uc55e\uc11c \uc124\uba85\ub4dc\ub9b0 “\uc124\uc815\uc774 \uc5c6\ub294 \uacbd\uc6b0”\uc640 \uac19\uc2b5\ub2c8\ub2e4. \uc11c\ubc84\ub294 \uc815\uc0c1 \uc2e4\ud589\ub418\uace0, \ube0c\ub77c\uc6b0\uc800\uc758 \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad\ub9cc \uc804\ubd80 \ucc28\ub2e8\ub429\ub2c8\ub2e4.<\/strong><\/p>\n\n\n\n
      \ucf54\ub4dc \ud750\ub984<\/h3>\n\n\n\n
      csharp<\/p>\n\n\n\n
      var frontPageOrigins = builder.Configuration.GetSection(\"Cors:AllowedOrigins\").Get<string[]>() ?? [];<\/code><\/pre>\n\n\n\n
        \n
      1. Cors:AllowedOrigins<\/code> \ud0a4\uac00 \uc5c6\uc73c\uba74 Get<string[]>()<\/code>\uc774 null<\/code>\uc744 \ubc18\ud658\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n
      2. ?? []<\/code> \ub54c\ubb38\uc5d0 \ube48 \ubc30\uc5f4\uc774 \ub429\ub2c8\ub2e4.<\/li>\n\n\n\n
      3. WithOrigins()<\/code>\uc5d0 \ube48 \ubc30\uc5f4\uc774 \ub4e4\uc5b4\uac00 “\ud5c8\uc6a9 \uc624\ub9ac\uc9c4\uc774 0\uac1c”\uc778 \uc815\ucc45\uc774 \ub9cc\ub4e4\uc5b4\uc9d1\ub2c8\ub2e4.<\/li>\n\n\n\n
      4. \uc608\uc678\ub294 \ubc1c\uc0dd\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/li>\n<\/ol>\n\n\n\n
        \uacb0\uacfc<\/h3>\n\n\n\n
        \ud638\ucd9c \ubc29\uc2dd<\/th>\uacb0\uacfc<\/th><\/tr><\/thead>
        \uc11c\ubc84 \uc2dc\uc791<\/td>\uc815\uc0c1<\/td><\/tr>
        Swagger UI (\uac19\uc740 \uc624\ub9ac\uc9c4)<\/td>\uc815\uc0c1<\/td><\/tr>
        Postman, curl, \uc11c\ubc84 \uac04 \ud638\ucd9c<\/td>\uc815\uc0c1 (CORS\ub294 \ube0c\ub77c\uc6b0\uc800\ub9cc \uc801\uc6a9)<\/td><\/tr>
        \ub2e4\ub978 \uc624\ub9ac\uc9c4\uc758 \ud504\ub860\ud2b8\uc5d4\ub4dc<\/td>\ube0c\ub77c\uc6b0\uc800\uac00 \ucc28\ub2e8<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \ube0c\ub77c\uc6b0\uc800 \ucf58\uc194\uc5d0\ub294 \uc774\ub7f0 \uc624\ub958\uac00 \ubcf4\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
        Access to fetch at 'https:\/\/localhost:5001\/api\/...' from origin 'http:\/\/localhost:3000'\nhas been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present<\/code><\/pre>\n\n\n\n
        \ucc38\uace0: \ub2e4\ub978 \uacf3\uc5d0\uc11c \uac12\uc774 \ub4e4\uc5b4\uc62c \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4<\/h3>\n\n\n\n
        appsettings.json<\/code>\uc5d0 \uc5c6\uc5b4\ub3c4 ASP.NET Core\ub294 \uc5ec\ub7ec \uc124\uc815 \uc18c\uc2a4\ub97c \ud569\uccd0\uc11c \uc77d\uae30 \ub54c\ubb38\uc5d0, \uc544\ub798 \uc911 \ud558\ub098\uc5d0 \uc788\uc73c\uba74 \uc815\uc0c1 \ub3d9\uc791\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
          \n
        • appsettings.Development.json<\/code> \uac19\uc740 \ud658\uacbd\ubcc4 \ud30c\uc77c<\/li>\n\n\n\n
        • \ud658\uacbd \ubcc0\uc218 (\ubc30\uc5f4\uc740 \uc778\ub371\uc2a4\ub97c \ubd99\uc785\ub2c8\ub2e4)<\/li>\n<\/ul>\n\n\n\n
            Cors__AllowedOrigins__0=http:\/\/localhost:3000\n  Cors__AllowedOrigins__1=https:\/\/myfront.example.com<\/code><\/pre>\n\n\n\n
            \n
          • User Secrets, \ucee4\ub9e8\ub4dc\ub77c\uc778 \uc778\uc790<\/li>\n<\/ul>\n\n\n\n
            \uadf8\ub798\uc11c \u201cjson\uc5d0 \uc5c6\ub294\ub370 \uc65c \ub418\uc9c0?\u201d \ub610\ub294 \u201cjson\uc5d0 \ub123\uc5c8\ub294\ub370 \uc65c \uc548 \ub418\uc9c0?\u201d \uac19\uc740 \uc0c1\ud669\uc774 \uc0dd\uae30\uba74, \ud658\uacbd\ubcc4 \ud30c\uc77c\uc774\ub098 \ud658\uacbd \ubcc0\uc218\uac00 \ub36e\uc5b4\uc4f0\uace0 \uc788\uc9c0 \uc54a\uc740\uc9c0 \ud655\uc778\ud574 \ubcf4\uc2dc\uba74 \uc88b\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
            <\/p>\n\n\n\n
            production\uc5d0\uc11c\ub294 \uaf2d \uc138\ud305\ud574\uc57c \ud558\ub098?<\/h2>\n\n\n\n
            \ud504\ub860\ud2b8\uc5d4\ub4dc\uac00 \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \uc774 API\ub97c \uc9c1\uc811 \ud638\ucd9c\ud55c\ub2e4\uba74 \ubc18\ub4dc\uc2dc \ud544\uc694\ud569\ub2c8\ub2e4.<\/strong> \ubc18\ub300\ub85c \ube0c\ub77c\uc6b0\uc800 \uad50\ucc28 \ucd9c\ucc98 \ud638\ucd9c\uc774 \uc804\ud600 \uc5c6\ub2e4\uba74 \ud544\uc694 \uc5c6\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
            \ud544\uc694\ud55c \uacbd\uc6b0 \/ \ubd88\ud544\uc694\ud55c \uacbd\uc6b0<\/h3>\n\n\n\n
            \uad6c\uc131<\/th>AllowedOrigins \ud544\uc694?<\/th><\/tr><\/thead>
            \ud504\ub860\ud2b8\uc5d4\ub4dc(React \ub4f1)\uac00 \ub2e4\ub978 \ub3c4\uba54\uc778\uc5d0\uc11c API\ub97c \uc9c1\uc811 \ud638\ucd9c<\/td>\ud544\uc694<\/strong><\/td><\/tr>
            \ud504\ub860\ud2b8\uc5d4\ub4dc\uc640 API\uac00 \uac19\uc740 \uc624\ub9ac\uc9c4 (\uc608: \ub9ac\ubc84\uc2a4 \ud504\ub85d\uc2dc\ub85c \/api<\/code>\ub97c \uac19\uc740 \ub3c4\uba54\uc778\uc5d0 \ubb36\uc74c)<\/td>\ubd88\ud544\uc694<\/td><\/tr>
            \uc11c\ubc84 \uac04 \ud638\ucd9c, \ubaa8\ubc14\uc77c \uc571, Postman \ub4f1 \ube0c\ub77c\uc6b0\uc800\uac00 \uc544\ub2cc \ud074\ub77c\uc774\uc5b8\ud2b8\ub9cc \uc0ac\uc6a9<\/td>\ubd88\ud544\uc694<\/td><\/tr>
            \ud504\ub860\ud2b8\uc5d4\ub4dc \uc11c\ubc84(Next.js \uc11c\ubc84 \uc0ac\uc774\ub4dc \ub4f1)\uac00 \ub300\uc2e0 \ud638\ucd9c<\/td>\ubd88\ud544\uc694<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            \uc774 \ud504\ub85c\uc81d\ud2b8\ub294 CORS \uc815\ucc45 \uc774\ub984\uc774 \"FrontPage\"<\/code>\uc774\uace0 X-Admin-Key<\/code> \ud5e4\ub354\ub97c \ud5c8\uc6a9\ud558\uace0 \uc788\uc73c\ub2c8, \ube0c\ub77c\uc6b0\uc800 \ud504\ub860\ud2b8\uc5d4\ub4dc\uac00 \uc9c1\uc811 \ud638\ucd9c\ud558\ub294 \uad6c\uc870\ub97c \uc5fc\ub450\uc5d0 \ub454 \uac83\uc73c\ub85c \ubcf4\uc785\ub2c8\ub2e4. \uadf8\ub807\ub2e4\uba74 production\uc5d0\uc11c \uc124\uc815\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
            \uaf2d appsettings.json<\/code>\uc5d0 \ub123\uc5b4\uc57c \ud558\ub098?<\/h3>\n\n\n\n
            \uc544\ub2d9\ub2c8\ub2e4. \uc5b4\ub290 \uc124\uc815 \uc18c\uc2a4\ub4e0 \uc0c1\uad00\uc5c6\uace0, production\uc5d0\uc11c\ub294 \uc624\ud788\ub824 \uc544\ub798 \ubc29\uc2dd\uc744 \ub9ce\uc774 \uc501\ub2c8\ub2e4.<\/p>\n\n\n\n
            1) appsettings.Production.json<\/code><\/strong><\/p>\n\n\n\n
            json<\/p>\n\n\n\n
            {\n  \"Cors\": {\n    \"AllowedOrigins\": [ \"https:\/\/myfront.example.com\" ]\n  }\n}<\/code><\/pre>\n\n\n\n
            ASPNETCORE_ENVIRONMENT=Production<\/code>\uc77c \ub54c appsettings.json<\/code> \uc704\uc5d0 \ub36e\uc5b4\uc501\ub2c8\ub2e4. \uac1c\ubc1c\uc6a9 localhost<\/code> \uc8fc\uc18c\ub294 appsettings.json<\/code>\/Development<\/code>\uc5d0 \ub450\uace0, \uc6b4\uc601 \ub3c4\uba54\uc778\ub9cc \uc5ec\uae30\uc5d0 \ub450\uba74 \ubd84\ub9ac\uac00 \uae54\ub054\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
            2) \ud658\uacbd \ubcc0\uc218<\/strong> (\ucee8\ud14c\uc774\ub108, \ud074\ub77c\uc6b0\ub4dc \ubc30\ud3ec\uc5d0\uc11c \ud754\ud568)<\/p>\n\n\n\n
            Cors__AllowedOrigins__0=https:\/\/myfront.example.com<\/code><\/pre>\n\n\n\n
            \uc124\uc815 \ud30c\uc77c\uc744 \uc218\uc815\ud558\uc9c0 \uc54a\uace0 \ubc30\ud3ec \ud658\uacbd\uc5d0\uc11c \ubc14\uafc0 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
            production \uc124\uc815 \uc2dc \uc8fc\uc758\uc810<\/h3>\n\n\n\n
              \n
            • https:\/\/<\/code>\ub85c \uc815\ud655\ud788 \uc801\uae30<\/strong>: \ud504\ub85c\ud1a0\ucf5c, \ub3c4\uba54\uc778, \ud3ec\ud2b8\uac00 \uc644\uc804\ud788 \uc77c\uce58\ud574\uc57c \ud569\ub2c8\ub2e4. \ub05d\uc5d0 \/<\/code>\ub97c \ubd99\uc774\uac70\ub098 \uacbd\ub85c\ub97c \ub123\uc73c\uba74 \ub9e4\uce6d\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n
            • \uac1c\ubc1c\uc6a9 \uc8fc\uc18c \uc81c\uac70<\/strong>: http:\/\/localhost:3000<\/code>\uc774 \uc6b4\uc601\uc5d0 \ub0a8\uc544 \uc788\uc9c0 \uc54a\uac8c \ud558\uc138\uc694.<\/li>\n\n\n\n
            • \uc640\uc77c\ub4dc\uce74\ub4dc\ub294 \ud53c\ud558\uae30<\/strong>: \uc774 \ucf54\ub4dc\ub294 X-Admin-Key<\/code>\ub77c\ub294 \uad00\ub9ac\uc790 \ud0a4 \ud5e4\ub354\ub97c \uc4f0\ubbc0\ub85c, \uc544\ubb34 \uc624\ub9ac\uc9c4\uc774\ub098 \ud5c8\uc6a9\ud558\ub294 \uac83\uc740 \uc704\ud5d8\ud569\ub2c8\ub2e4. \uc9c0\uae08\ucc98\ub7fc \uba85\uc2dc\uc801 \ubaa9\ub85d\ub9cc \uc4f0\ub294 \uac8c \ub9de\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n
            • \ube48 \uac12\uc774\uba74 \uc870\uc6a9\ud788 \uc2e4\ud328<\/strong>: \uc55e\uc11c \uc124\uba85\ud588\ub4ef \uc624\ub958 \uc5c6\uc774 \uc2dc\uc791\ub418\uace0 \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c\ub9cc CORS \uc624\ub958\uac00 \ub0a9\ub2c8\ub2e4. \ubc30\ud3ec \uc9c1\ud6c4 \ud504\ub860\ud2b8\uc5d4\ub4dc \uc5f0\ub3d9 \ud655\uc778\uc774 \ud544\uc694\ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n\n\n\n
              \ud55c \uac00\uc9c0 \ub354<\/h3>\n\n\n\n
              \ucf54\ub4dc\uc5d0\uc11c ?? []<\/code>\ub85c \uc870\uc6a9\ud788 \ub118\uc5b4\uac00\ub294 \ub300\uc2e0, production\uc5d0\uc11c \uac12\uc774 \ube44\uc5b4 \uc788\uc73c\uba74 \uc2dc\uc791 \uc2dc\uc810\uc5d0 \ubc14\ub85c \uc2e4\ud328\ud558\uac8c \ub9cc\ub4e4 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
              csharp<\/p>\n\n\n\n
              if (!builder.Environment.IsDevelopment() && frontPageOrigins.Length == 0)\n    throw new InvalidOperationException(\"Cors:AllowedOrigins must be configured in production.\");<\/code><\/pre>\n\n\n\n
              \uc124\uc815 \ub204\ub77d\uc744 \ubc30\ud3ec \uc9c1\ud6c4 \ubc14\ub85c \ubc1c\uacac\ud560 \uc218 \uc788\uc5b4\uc11c, \uc6b4\uc601\uc5d0\uc11c \uc6d0\uc778 \ubaa8\ub97c CORS \uc624\ub958\ub97c \ucc3e\ub294 \uc2dc\uac04\uc744 \uc904\uc5ec \uc90d\ub2c8\ub2e4.<\/p>\n\n\n\n
              AllowedOrigins\uac00 AllowedHosts\ubcf4\ub2e4 \uc548\uc804\ud55c\uac00?<\/h2>\n\n\n\n
              “\ub354 \uc548\uc804\ud558\ub2e4\/\ub35c \uc548\uc804\ud558\ub2e4”\ub85c \ube44\uad50\ud558\uae30 \uc5b4\ub835\uc2b5\ub2c8\ub2e4.<\/strong> \uc11c\ub85c \ub9c9\ub294 \ub300\uc0c1\uc774 \ub2e4\ub978 \ubcc4\uac1c\uc758 \ubc29\uc5b4 \uc7a5\uce58\uc774\uace0, \ub458 \ub2e4 \uc778\uc99d\uc744 \ub300\uc2e0\ud558\uc9c0 \ubabb\ud569\ub2c8\ub2e4.<\/strong><\/p>\n\n\n\n
              \uac01\uac01\uc774 \ub9c9\ub294 \uac83<\/h3>\n\n\n\n
              <\/th>AllowedHosts<\/code><\/th>Cors:AllowedOrigins<\/code><\/th><\/tr><\/thead>
              \ub9c9\ub294 \uc704\ud611<\/td>Host \ud5e4\ub354 \uc870\uc791 (Host Header Injection)<\/td>\uc545\uc131 \uc6f9\uc0ac\uc774\ud2b8\uac00 \uc0ac\uc6a9\uc790 \ube0c\ub77c\uc6b0\uc800\ub97c \uc774\uc6a9\ud574 API \uc751\ub2f5\uc744 \uc77d\ub294 \uac83<\/td><\/tr>
              \ub204\uac00 \uac15\uc81c\ud558\ub098<\/td>\uc11c\ubc84<\/strong>\uac00 \uc694\uccad\uc744 \uac70\ubd80 (400)<\/td>\ube0c\ub77c\uc6b0\uc800<\/strong>\uac00 \uc751\ub2f5\uc744 \ub9c9\uc74c<\/td><\/tr>
              \uc6b0\ud68c \uac00\ub2a5\uc131<\/td>\ud5e4\ub354\ub97c \ub9c8\uc74c\ub300\ub85c \ubc14\uafd4 \ubcf4\ub0b4\uba74 \ubaa9\ub85d\uc5d0 \uc788\ub294 \uac12\uc73c\ub85c \uc704\uc870 \uac00\ub2a5<\/td>curl, Postman, \uc11c\ubc84 \ucf54\ub4dc\ub294 CORS\ub97c \uc544\uc608 \ubb34\uc2dc<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              \ub458 \ub2e4 “\ubcf4\uc548 \uc7a5\uce58”\ub85c \uacfc\uc2e0\ud558\uba74 \uc548 \ub418\ub294 \uc774\uc720<\/h3>\n\n\n\n
              CORS\ub294 \uc11c\ubc84\ub97c \ubcf4\ud638\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/strong> \ube0c\ub77c\uc6b0\uc800\uac00 “\ub2e4\ub978 \uc0ac\uc774\ud2b8\uc758 JS\uac00 \uc751\ub2f5\uc744 \uc77d\uc9c0 \ubabb\ud558\uac8c” \ub9c9\uc744 \ubfd0\uc774\ub77c, \uacf5\uaca9\uc790\uac00 curl\uc774\ub098 \uc2a4\ud06c\ub9bd\ud2b8\ub85c \uc9c1\uc811 API\ub97c \ud638\ucd9c\ud558\uba74 CORS\uc640 \ubb34\uad00\ud558\uac8c \uc694\uccad\uc774 \uc11c\ubc84\uc5d0 \ub3c4\ub2ec\ud569\ub2c8\ub2e4. \uc774 \ud504\ub85c\uc81d\ud2b8\uc5d0\uc11c \uc2e4\uc81c\ub85c API\ub97c \uc9c0\ud0a4\ub294 \uac83\uc740 CORS\uac00 \uc544\ub2c8\ub77c X-Admin-Key<\/code> \uac80\uc0ac \ubbf8\ub4e4\uc6e8\uc5b4<\/strong>\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
              Host \uac80\uc0ac\ub3c4 \uc704\uc870\uac00 \uc27d\uc2b5\ub2c8\ub2e4.<\/strong> \uacf5\uaca9\uc790\uac00 \uc9c1\uc811 \uc694\uccad\uc744 \ubcf4\ub0bc \ub54c\ub294 Host<\/code> \ud5e4\ub354\ub97c \ud5c8\uc6a9 \ubaa9\ub85d\uc758 \uac12\uc73c\ub85c \uc801\uc5b4 \ubcf4\ub0b4\uba74 \ud1b5\uacfc\ud569\ub2c8\ub2e4. \uadf8\ub798\uc11c \uc8fc\ub85c \ub9ac\ubc84\uc2a4 \ud504\ub85d\uc2dc \ub4a4\uc5d0\uc11c \uc798\ubabb\ub41c Host\ub85c URL\uc774 \uc0dd\uc131\ub418\ub294 \uc0ac\uace0\ub97c \uc904\uc774\ub294 \uc6a9\ub3c4\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
              \uc774 \ud504\ub85c\uc81d\ud2b8\uc5d0\uc11c\uc758 \uc6b0\uc120\uc21c\uc704<\/h3>\n\n\n\n
              \ubcf4\ud638 \ud6a8\uacfc\uac00 \ud070 \uc21c\uc11c\ub300\ub85c \ubcf4\uba74:<\/p>\n\n\n\n
                \n
              1. API \ud0a4 \uc778\uc99d \ubbf8\ub4e4\uc6e8\uc5b4<\/strong> (\uc2e4\uc81c \uc811\uadfc \ud1b5\uc81c, \uac00\uc7a5 \uc911\uc694)<\/li>\n\n\n\n
              2. AllowedOrigins<\/code><\/strong> (\ube0c\ub77c\uc6b0\uc800 \ud658\uacbd\uc5d0\uc11c \ub2e4\ub978 \uc0ac\uc774\ud2b8\uac00 \uc751\ub2f5\uc744 \uc77d\ub294 \uac83\uc744 \ucc28\ub2e8, \uc9c0\uae08\ucc98\ub7fc \uba85\uc2dc\uc801 \ubaa9\ub85d \uc720\uc9c0)<\/li>\n\n\n\n
              3. AllowedHosts<\/code><\/strong> (\ubcf4\uc870\uc801 \ubc29\uc5b4, \"*\"<\/code>\uc5ec\ub3c4 \uc774 API\ub294 URL\uc744 \uc0dd\uc131\ud574 \ub0b4\ubcf4\ub0b4\uc9c0 \uc54a\uc544 \uc2e4\uc9c8 \uc704\ud5d8\uc774 \uc791\uc74c)<\/li>\n<\/ol>\n\n\n\n
                \uc815\ub9ac\ud558\uba74, \ube0c\ub77c\uc6b0\uc800 \ud504\ub860\ud2b8\uc5d4\ub4dc\ub97c \uc4f0\ub294 \uc774 \uad6c\uc870\uc5d0\uc11c\ub294 AllowedOrigins<\/code>\ub97c \uc815\ud655\ud788 \uc124\uc815\ud558\ub294 \uac83\uc774 AllowedHosts<\/code>\ubcf4\ub2e4 \uc2e4\ubb34\uc801\uc73c\ub85c \ub354 \uc758\ubbf8\uac00 \ud07d\ub2c8\ub2e4. \ub2e4\ub9cc “\ub204\uac00 \uc774 API\ub97c \ud638\ucd9c\ud560 \uc218 \uc788\ub294\uac00”\ub97c \uacb0\uc815\ud558\ub294 \uac83\uc740 \ub458 \ub2e4 \uc544\ub2c8\uace0 \uc778\uc99d\uc774\ub77c\ub294 \uc810\uc744 \uae30\uc5b5\ud574 \ub450\uc138\uc694.<\/p>\n\n\n\n
                \ub458 \ub2e4 \uc4f0\uba74 \ub354 \uc548\uc804\ud55c\uac00?<\/h2>\n\n\n\n
                \ub124, \uc870\uae08\uc740 \ub354 \uc548\uc804\ud574\uc9d1\ub2c8\ub2e4.<\/strong> \ub2e4\ub9cc \uc11c\ub85c \ub9c9\ub294 \ub300\uc0c1\uc774 \ub2ec\ub77c\uc11c \uacb9\uce58\ub294 \ubc29\uc5b4\uac00 \uc544\ub2c8\ub77c \uc11c\ub85c \ub2e4\ub978 \ube48\ud2c8\uc744 \uac01\uac01 \uba54\uc6b0\ub294 \uac83<\/strong>\uc774\uace0, \ud6a8\uacfc\ub294 “\ubcf4\uc870\uc801”\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
                \ud568\uaed8 \uc4f0\uba74 \uc5bb\ub294 \uac83<\/h3>\n\n\n\n
                \uc870\ud569<\/th>\ud6a8\uacfc<\/th><\/tr><\/thead>
                AllowedOrigins<\/code>\ub9cc<\/td>\ub2e4\ub978 \uc0ac\uc774\ud2b8\uc758 \ube0c\ub77c\uc6b0\uc800 JS\uac00 \uc751\ub2f5\uc744 \uc77d\ub294 \uac83 \ucc28\ub2e8<\/td><\/tr>
                AllowedHosts<\/code>\ub9cc<\/td>\uc5c9\ub6b1\ud55c Host \ud5e4\ub354\ub85c \ub4e4\uc5b4\uc624\ub294 \uc694\uccad \uac70\ubd80<\/td><\/tr>
                \ub458 \ub2e4<\/strong><\/td>\ub450 \uc885\ub958\uc758 \uc704\ud611\uc744 \uac01\uac01 \uc904\uc784 (\uc704 \ub458\uc744 \ud569\uce5c \ud6a8\uacfc)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                \ud55c\ucabd\uc774 \ub2e4\ub978 \ucabd\uc744 \ub300\uc2e0\ud574 \uc8fc\uc9c0 \uc54a\uae30 \ub54c\ubb38\uc5d0, \ub458 \ub2e4 \uc124\uc815\ud558\uba74 \ub9c9\ub294 \ubc94\uc704\uac00 \ub113\uc5b4\uc9d1\ub2c8\ub2e4.<\/p>\n\n\n\n
                \uc6b4\uc601 \ud658\uacbd \uc124\uc815 \uc608\uc2dc<\/h3>\n\n\n\n
                json<\/p>\n\n\n\n
                {\n  \"AllowedHosts\": \"api.example.com\",\n  \"Cors\": {\n    \"AllowedOrigins\": [ \"https:\/\/myfront.example.com\" ]\n  }\n}<\/code><\/pre>\n\n\n\n