.NET Aspire中泛型扩展方法动态配置多服务CORS问题

在.NET Aspire项目的ServiceDefaults中编写泛型扩展方法ConfigureCors以避免重复代码，但不同服务的CORS配置属性存在差异，当前代码依赖固定属性的实体类，而实体类由各服务自行定义，需要修改扩展方法实现动态读取属性完成CORS配置。

当前扩展方法代码：

public static class CorsExtensions
{
    /**
     * appsettings.json configuration
     * 
     * CorsPolicy:{
     *      "PolicyName": "",
     *      "AllowedHosts": "*",
     *      "AllowedOrigins": "http://localhost:4200",
     *      "AllowedHeaders": "content-type",
     *      "AllowedMethods": "GET,POST,PUT,DELETE"
     * }
     */
    public static IServiceCollection ConfigureCors<T>(this IServiceCollection services) where T: class
    {
        var configuration = services.BuildServiceProvider().GetService<IConfiguration>();
        var corsPolicy = services.Configure<T>(configuration!.GetSection("CorsPolicy"));
        services.AddCors(options =>
        {
            options.AddPolicy(name: corsPolicy.PolicyName,
                policy => policy.WithOrigins(corsPolicy.AllowedOrigins)
                    .AllowCredentials()
                    .WithHeaders(corsPolicy.AllowedHeaders)
                    .WithMethods(corsPolicy.AllowedMethods)
                    );
        });
        return services;
    }

    public static WebApplication AddCorsMiddleware<T>(this WebApplication app)
    {
        app.UseCors(T.PolicyName);
        return app;
    }
}

服务A的调用与实体类定义：

builder.Services.ConfigureCors<CorsPolicy>();

public class CorsPolicy
{
    public string PolicyName { get; set; } 
    public string AllowedHosts { get; set; }
    public string AllowedMethods { get; set; }
    public string AllowedHeaders { get; set; }
    public string AllowedOrigins { get; set; }
}

提供两种适配动态属性的实现方案，可根据场景选择：

方案1：接口约定+反射（保留强类型实体类） #

通过定义核心接口约束必填属性，结合反射动态读取各服务实体类的扩展属性，兼顾强类型和灵活性。

步骤1：定义核心接口 #

public interface ICorsPolicySettings
{
    string PolicyName { get; set; }
}

各服务的实体类实现该接口，按需添加自定义属性：

// 服务A配置类
public class CorsPolicy : ICorsPolicySettings
{
    public string PolicyName { get; set; }
    public string AllowedOrigins { get; set; }
    public string AllowedHeaders { get; set; }
    public string AllowedMethods { get; set; }
}

// 服务B配置类（属性与A不同）
public class ServiceBCorsPolicy : ICorsPolicySettings
{
    public string PolicyName { get; set; }
    public string[] AllowedOrigins { get; set; } // 支持数组类型
    public bool AllowCredentials { get; set; }
    public string AllowedMethods { get; set; }
}

步骤2：修改扩展方法 #

public static class CorsExtensions
{
    public static IServiceCollection ConfigureCors<T>(this IServiceCollection services) where T : class, ICorsPolicySettings
    {
        var configuration = services.BuildServiceProvider().GetRequiredService<IConfiguration>();
        var corsSection = configuration.GetSection("CorsPolicy");
        var policySettings = corsSection.Get<T>() ?? throw new InvalidOperationException("未找到CorsPolicy配置");

        services.AddCors(options =>
        {
            options.AddPolicy(policySettings.PolicyName, policy =>
            {
                var properties = typeof(T).GetProperties();

                // 处理AllowedOrigins（兼容字符串/数组）
                var originsProp = properties.FirstOrDefault(p => p.Name.Equals("AllowedOrigins", StringComparison.OrdinalIgnoreCase));
                if (originsProp != null)
                {
                    var originsValue = originsProp.GetValue(policySettings);
                    if (originsValue is string originsStr && !string.IsNullOrEmpty(originsStr))
                    {
                        policy.WithOrigins(originsStr.Split(',', StringSplitOptions.RemoveEmptyEntries));
                    }
                    else if (originsValue is string[] originsArray && originsArray.Any())
                    {
                        policy.WithOrigins(originsArray);
                    }
                }

                // 处理AllowedMethods
                var methodsProp = properties.FirstOrDefault(p => p.Name.Equals("AllowedMethods", StringComparison.OrdinalIgnoreCase));
                if (methodsProp != null)
                {
                    var methodsValue = methodsProp.GetValue(policySettings) as string;
                    if (!string.IsNullOrEmpty(methodsValue))
                    {
                        policy.WithMethods(methodsValue.Split(',', StringSplitOptions.RemoveEmptyEntries));
                    }
                }

                // 处理AllowedHeaders
                var headersProp = properties.FirstOrDefault(p => p.Name.Equals("AllowedHeaders", StringComparison.OrdinalIgnoreCase));
                if (headersProp != null)
                {
                    var headersValue = headersProp.GetValue(policySettings) as string;
                    if (!string.IsNullOrEmpty(headersValue))
                    {
                        policy.WithHeaders(headersValue.Split(',', StringSplitOptions.RemoveEmptyEntries));
                    }
                }

                // 处理AllowCredentials
                var credentialsProp = properties.FirstOrDefault(p => p.Name.Equals("AllowCredentials", StringComparison.OrdinalIgnoreCase));
                if (credentialsProp != null)
                {
                    var credentialsValue = credentialsProp.GetValue(policySettings) as bool?;
                    if (credentialsValue.HasValue && credentialsValue.Value)
                    {
                        policy.AllowCredentials();
                    }
                }

                // 处理AllowedHosts
                var hostsProp = properties.FirstOrDefault(p => p.Name.Equals("AllowedHosts", StringComparison.OrdinalIgnoreCase));
                if (hostsProp != null)
                {
                    var hostsValue = hostsProp.GetValue(policySettings) as string;
                    if (!string.IsNullOrEmpty(hostsValue))
                    {
                        policy.WithHosts(hostsValue.Split(',', StringSplitOptions.RemoveEmptyEntries));
                    }
                }
            });
        });

        services.AddSingleton(policySettings);
        return services;
    }

    public static WebApplication AddCorsMiddleware<T>(this WebApplication app) where T : class, ICorsPolicySettings
    {
        var policySettings = app.Services.GetRequiredService<T>();
        app.UseCors(policySettings.PolicyName);
        return app;
    }
}

调用方式 #

服务A：

builder.Services.ConfigureCors<CorsPolicy>();
app.AddCorsMiddleware<CorsPolicy>();

服务B：

builder.Services.ConfigureCors<ServiceBCorsPolicy>();
app.AddCorsMiddleware<ServiceBCorsPolicy>();

方案2：直接解析配置节（无需实体类） #

跳过实体类定义，直接读取配置节的键值对动态构建CORS策略，配置更灵活。

修改扩展方法 #

public static class CorsExtensions
{
    public static IServiceCollection ConfigureCors(this IServiceCollection services, string policySectionName = "CorsPolicy")
    {
        var configuration = services.BuildServiceProvider().GetRequiredService<IConfiguration>();
        var corsSection = configuration.GetSection(policySectionName);
        if (!corsSection.Exists())
            throw new InvalidOperationException($"配置节 {policySectionName} 不存在");

        var policyName = corsSection["PolicyName"] ?? throw new InvalidOperationException("未配置PolicyName");

        services.AddCors(options =>
        {
            options.AddPolicy(policyName, policy =>
            {
                // 解析AllowedOrigins
                var origins = corsSection["AllowedOrigins"];
                if (!string.IsNullOrEmpty(origins))
                {
                    policy.WithOrigins(origins.Split(',', StringSplitOptions.RemoveEmptyEntries));
                }

                // 解析AllowedMethods
                var methods = corsSection["AllowedMethods"];
                if (!string.IsNullOrEmpty(methods))
                {
                    policy.WithMethods(methods.Split(',', StringSplitOptions.RemoveEmptyEntries));
                }

                // 解析AllowedHeaders
                var headers = corsSection["AllowedHeaders"];
                if (!string.IsNullOrEmpty(headers))
                {
                    policy.WithHeaders(headers.Split(',', StringSplitOptions.RemoveEmptyEntries));
                }

                // 解析AllowCredentials
                if (bool.TryParse(corsSection["AllowCredentials"], out var allowCreds) && allowCreds)
                {
                    policy.AllowCredentials();
                }

                // 解析AllowedHosts
                var hosts = corsSection["AllowedHosts"];
                if (!string.IsNullOrEmpty(hosts))
                {
                    policy.WithHosts(hosts.Split(',', StringSplitOptions.RemoveEmptyEntries));
                }
            });
        });

        services.AddSingleton(policyName);
        return services;
    }

    public static WebApplication AddCorsMiddleware(this WebApplication app)
    {
        var policyName = app.Services.GetRequiredService<string>();
        app.UseCors(policyName);
        return app;
    }
}

调用方式 #

所有服务统一调用：

builder.Services.ConfigureCors();
app.AddCorsMiddleware();

每个服务在appsettings.json中配置对应CORS规则即可：

{
  "CorsPolicy": {
    "PolicyName": "ServiceAPolicy",
    "AllowedOrigins": "http://localhost:4200,https://app.example.com",
    "AllowedMethods": "GET,POST",
    "AllowCredentials": true
  }
}

方案对比 #

• 方案1：保留强类型实体类的编译时校验，同时支持灵活扩展属性，适合需要在代码中直接使用配置值的场景。
• 方案2：无需定义实体类，配置变更无需修改代码，适合快速迭代或属性变化频繁的场景。

内容的提问来源于stack exchange，提问作者Assad Nazar