diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Api.csproj b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Api.csproj
new file mode 100644
index 000000000..0268d75dd
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Api.csproj
@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
+  </ItemGroup>
+
+</Project>
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Controllers/WeatherForecastController.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Controllers/WeatherForecastController.cs
new file mode 100644
index 000000000..8cc0275a6
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Controllers/WeatherForecastController.cs
@@ -0,0 +1,35 @@
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Api.Controllers;
+
+[ApiController]
+[Route("[controller]")]
+public class WeatherForecastController : ControllerBase
+{
+    private static readonly string[] Summaries =
+    [
+        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
+    ];
+
+    [EnableCors("CorsPolicy")]
+    [HttpGet]
+    public IEnumerable<WeatherForecast> Get()
+    {
+        var rng = new Random();
+        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
+        (
+            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
+            rng.Next(-20, 55),
+            Summaries[rng.Next(Summaries.Length)]
+        ))
+        .ToArray();
+    }
+
+    [EnableCors("AnotherCorsPolicy")]
+    [HttpGet("anotherPolicyExample")]
+    public IActionResult GetTempAboveLimit()
+    {
+        return Ok("This action is protected with another named CORS policy");
+    }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Program.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Program.cs
new file mode 100644
index 000000000..f7677d9ba
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Program.cs
@@ -0,0 +1,78 @@
+using Microsoft.Net.Http.Headers;
+
+var builder = WebApplication.CreateBuilder(args);
+
+const string policyName = "CorsPolicy";
+const string anotherPolicyName = "AnotherCorsPolicy";
+
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy(name: policyName, builder =>
+    {
+        builder.WithOrigins("https://localhost:5011")
+            .AllowAnyHeader()
+            .WithMethods("GET");
+    });
+    options.AddPolicy(name: anotherPolicyName, builder =>
+    {
+        builder.WithOrigins("https://localhost:5021")
+            .WithHeaders(HeaderNames.ContentType, HeaderNames.Accept)
+            .WithMethods("GET")
+            .WithExposedHeaders("X-Pagination");
+    });
+});
+
+builder.Services.AddControllers();
+
+builder.Services.AddOpenApi();
+builder.Services.AddProblemDetails();
+
+var app = builder.Build();
+
+if (app.Environment.IsDevelopment())
+{
+    app.MapOpenApi();
+    app.UseDeveloperExceptionPage();
+}
+else
+{
+    app.UseExceptionHandler();
+    app.UseHsts();
+    app.UseStatusCodePages();
+}
+
+app.UseHttpsRedirection();
+
+app.UseCors();
+
+app.UseAuthentication();
+app.UseAuthorization();
+
+app.MapControllers();
+
+var summaries = new[]
+{
+    "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
+};
+
+app.MapGet("/minimal/weatherforecast", () =>
+    {
+        var forecast = Enumerable.Range(1, 5).Select(index =>
+                new WeatherForecast
+                (
+                    DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
+                    Random.Shared.Next(-20, 55),
+                    summaries[Random.Shared.Next(summaries.Length)]
+                ))
+            .ToArray();
+        return forecast;
+    })
+    .WithName("GetWeatherForecast")
+    .RequireCors(policyName);
+
+app.Run();
+
+public record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
+{
+    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Properties/launchSettings.json b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Properties/launchSettings.json
new file mode 100644
index 000000000..910892bd0
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/Properties/launchSettings.json
@@ -0,0 +1,14 @@
+{
+  "profiles": {
+    "Api": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "launchUrl": "weatherforecast",
+      "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.Development.json b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.Development.json
new file mode 100644
index 000000000..8983e0fc1
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.Development.json
@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft": "Warning",
+      "Microsoft.Hosting.Lifetime": "Information"
+    }
+  }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.json b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.json
new file mode 100644
index 000000000..d9d9a9bff
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Api/appsettings.json
@@ -0,0 +1,10 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft": "Warning",
+      "Microsoft.Hosting.Lifetime": "Information"
+    }
+  },
+  "AllowedHosts": "*"
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/App.razor b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/App.razor
new file mode 100644
index 000000000..6f67a6ea6
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/App.razor
@@ -0,0 +1,10 @@
+<Router AppAssembly="@typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)" />
+    </Found>
+    <NotFound>
+        <LayoutView Layout="@typeof(MainLayout)">
+            <p>Sorry, there's nothing at this address.</p>
+        </LayoutView>
+    </NotFound>
+</Router>
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Client.csproj b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Client.csproj
new file mode 100644
index 000000000..ff3290868
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Client.csproj
@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk.BlazorWebAssembly">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.12" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.12" PrivateAssets="all" />
+  </ItemGroup>
+
+</Project>
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Pages/FetchData.razor b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Pages/FetchData.razor
new file mode 100644
index 000000000..60a3cfb00
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Pages/FetchData.razor
@@ -0,0 +1,55 @@
+@page "/fetchdata"
+@inject HttpClient Http
+
+<h1>Weather forecast</h1>
+
+<p>This component demonstrates fetching data from the server.</p>
+
+@if (forecasts == null)
+{
+    <p><em>Loading...</em></p>
+}
+else
+{
+    <table class="table">
+        <thead>
+            <tr>
+                <th>Date</th>
+                <th>Temp. (C)</th>
+                <th>Temp. (F)</th>
+                <th>Summary</th>
+            </tr>
+        </thead>
+        <tbody>
+            @foreach (var forecast in forecasts)
+            {
+                <tr>
+                    <td>@forecast.Date.ToShortDateString()</td>
+                    <td>@forecast.TemperatureC</td>
+                    <td>@forecast.TemperatureF</td>
+                    <td>@forecast.Summary</td>
+                </tr>
+            }
+        </tbody>
+    </table>
+}
+
+@code {
+    private WeatherForecast[]? forecasts;
+
+    protected override async Task OnInitializedAsync()
+    {
+        forecasts = await Http.GetFromJsonAsync<WeatherForecast[]>("/weatherforecast");
+    }
+
+    public class WeatherForecast
+    {
+        public DateOnly Date { get; set; }
+
+        public int TemperatureC { get; set; }
+
+        public string? Summary { get; set; }
+
+        public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
+    }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Program.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Program.cs
new file mode 100644
index 000000000..fbe28e2c4
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Program.cs
@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
+using Client;
+
+var builder = WebAssemblyHostBuilder.CreateDefault(args);
+builder.RootComponents.Add<App>("#app");
+
+builder.Services.AddScoped(_ => new HttpClient { BaseAddress = new Uri("https://localhost:5001") });
+
+await builder.Build().RunAsync();
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Properties/launchSettings.json b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Properties/launchSettings.json
new file mode 100644
index 000000000..759c8462c
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Properties/launchSettings.json
@@ -0,0 +1,14 @@
+{
+  "profiles": {
+    "Client": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}",
+      "applicationUrl": "https://localhost:5011;http://localhost:5010",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Shared/MainLayout.razor b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Shared/MainLayout.razor
new file mode 100644
index 000000000..7bb971954
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/Shared/MainLayout.razor
@@ -0,0 +1,11 @@
+@inherits LayoutComponentBase
+
+<div class="page">
+    <nav class="top-row">
+        <NavLink href="fetchdata">Fetch data</NavLink>
+    </nav>
+
+    <main class="content">
+        @Body
+    </main>
+</div>
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/_Imports.razor b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/_Imports.razor
new file mode 100644
index 000000000..87e06ca17
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/_Imports.razor
@@ -0,0 +1,6 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using Client
+@using Client.Shared
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/css/app.css b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/css/app.css
new file mode 100644
index 000000000..d88d4a33a
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/css/app.css
@@ -0,0 +1,36 @@
+html, body {
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+}
+
+.top-row {
+    padding: 0.5rem 1.5rem;
+    border-bottom: 1px solid #d6d5d5;
+}
+
+.content {
+    padding: 1.1rem 1.5rem;
+}
+
+.table th, .table td {
+    padding: 0.25rem 0.75rem;
+    text-align: left;
+}
+
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/index.html b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/index.html
new file mode 100644
index 000000000..ba0cf1fc8
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Client/wwwroot/index.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Client</title>
+    <base href="/" />
+    <link href="css/app.css" rel="stylesheet" />
+</head>
+
+<body>
+    <div id="app">Loading...</div>
+
+    <div id="blazor-error-ui">
+        An unhandled error has occurred.
+        <a href="" class="reload">Reload</a>
+        <a class="dismiss">X</a>
+    </div>
+    <script src="_framework/blazor.webassembly.js"></script>
+</body>
+
+</html>
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/EnablingCorsInAspNetCore.sln b/aspnetcore-webapi/EnablingCorsInAspNetCore/EnablingCorsInAspNetCore.sln
new file mode 100644
index 000000000..5b769bfa0
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/EnablingCorsInAspNetCore.sln
@@ -0,0 +1,62 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Api", "Api\Api.csproj", "{A10D17C9-E47B-473F-8C6B-76E981A2748D}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Client", "Client\Client.csproj", "{9F981D85-267A-46F6-8B0E-C8D91442F024}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tests", "Tests\Tests.csproj", "{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|Any CPU = Release|Any CPU
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|x64.Build.0 = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Debug|x86.Build.0 = Debug|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|x64.ActiveCfg = Release|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|x64.Build.0 = Release|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|x86.ActiveCfg = Release|Any CPU
+		{A10D17C9-E47B-473F-8C6B-76E981A2748D}.Release|x86.Build.0 = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|x64.Build.0 = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Debug|x86.Build.0 = Debug|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|Any CPU.Build.0 = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|x64.ActiveCfg = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|x64.Build.0 = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|x86.ActiveCfg = Release|Any CPU
+		{9F981D85-267A-46F6-8B0E-C8D91442F024}.Release|x86.Build.0 = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|x64.Build.0 = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Debug|x86.Build.0 = Debug|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|x64.ActiveCfg = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|x64.Build.0 = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|x86.ActiveCfg = Release|Any CPU
+		{FDBF3625-CB5D-4102-B8E2-0DCC74C7B5D3}.Release|x86.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/ApiApplicationFactory.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/ApiApplicationFactory.cs
new file mode 100644
index 000000000..ef9b9c75c
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/ApiApplicationFactory.cs
@@ -0,0 +1,5 @@
+namespace Tests;
+
+public class ApiApplicationFactory : WebApplicationFactory<Program>
+{
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/CorsIntegrationTest.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/CorsIntegrationTest.cs
new file mode 100644
index 000000000..6965a90d5
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/CorsIntegrationTest.cs
@@ -0,0 +1,70 @@
+namespace Tests;
+
+public class CorsIntegrationTest : IClassFixture<ApiApplicationFactory>
+{
+    private const string ClientOrigin = "https://localhost:5011";
+    private const string OtherClientOrigin = "https://localhost:5021";
+
+    private readonly HttpClient _client;
+
+    public CorsIntegrationTest(ApiApplicationFactory factory)
+    {
+        _client = factory.CreateClient();
+    }
+
+    [Theory]
+    [InlineData("/weatherforecast")]
+    [InlineData("/minimal/weatherforecast")]
+    public async Task GivenAllowedOrigin_WhenGetIsSent_ThenAllowOriginHeaderEchoesTheOrigin(string url)
+    {
+        var request = new HttpRequestMessage(HttpMethod.Get, url);
+        request.Headers.Add(HeaderNames.Origin, ClientOrigin);
+
+        var response = await _client.SendAsync(request);
+
+        response.EnsureSuccessStatusCode();
+        Assert.Equal(ClientOrigin, Assert.Single(response.Headers.GetValues(HeaderNames.AccessControlAllowOrigin)));
+    }
+
+    [Theory]
+    [InlineData("/weatherforecast", "https://unknown.com")]
+    [InlineData("/weatherforecast", OtherClientOrigin)]
+    [InlineData("/minimal/weatherforecast", "https://unknown.com")]
+    public async Task GivenDisallowedOrigin_WhenGetIsSent_ThenNoAllowOriginHeaderIsReturned(string url, string origin)
+    {
+        var request = new HttpRequestMessage(HttpMethod.Get, url);
+        request.Headers.Add(HeaderNames.Origin, origin);
+
+        var response = await _client.SendAsync(request);
+
+        response.EnsureSuccessStatusCode();
+        Assert.False(response.Headers.Contains(HeaderNames.AccessControlAllowOrigin));
+    }
+
+    [Fact]
+    public async Task GivenAllowedOrigin_WhenPreflightIsSent_ThenAllowMethodsHeaderListsGet()
+    {
+        var request = new HttpRequestMessage(HttpMethod.Options, "/weatherforecast");
+        request.Headers.Add(HeaderNames.Origin, ClientOrigin);
+        request.Headers.Add(HeaderNames.AccessControlRequestMethod, "GET");
+
+        var response = await _client.SendAsync(request);
+
+        Assert.Equal(System.Net.HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal(ClientOrigin, Assert.Single(response.Headers.GetValues(HeaderNames.AccessControlAllowOrigin)));
+        Assert.Equal("GET", Assert.Single(response.Headers.GetValues(HeaderNames.AccessControlAllowMethods)));
+    }
+
+    [Fact]
+    public async Task GivenAnotherPolicyOrigin_WhenGetIsSent_ThenPaginationHeaderIsExposed()
+    {
+        var request = new HttpRequestMessage(HttpMethod.Get, "/weatherforecast/anotherPolicyExample");
+        request.Headers.Add(HeaderNames.Origin, OtherClientOrigin);
+
+        var response = await _client.SendAsync(request);
+
+        response.EnsureSuccessStatusCode();
+        Assert.Equal(OtherClientOrigin, Assert.Single(response.Headers.GetValues(HeaderNames.AccessControlAllowOrigin)));
+        Assert.Equal("X-Pagination", Assert.Single(response.Headers.GetValues(HeaderNames.AccessControlExposeHeaders)));
+    }
+}
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/GlobalUsings.cs b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/GlobalUsings.cs
new file mode 100644
index 000000000..45eb9f6c6
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/GlobalUsings.cs
@@ -0,0 +1,3 @@
+global using Xunit;
+global using Microsoft.AspNetCore.Mvc.Testing;
+global using Microsoft.Net.Http.Headers;
diff --git a/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/Tests.csproj b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/Tests.csproj
new file mode 100644
index 000000000..eb8616765
--- /dev/null
+++ b/aspnetcore-webapi/EnablingCorsInAspNetCore/Tests/Tests.csproj
@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="coverlet.collector" Version="10.1.0">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Api\Api.csproj" />
+  </ItemGroup>
+
+</Project>