Investigate CORS / authorization for anonymous requests

[hburn7]

Filtering of anonymous requests

We need to identify the proper way for anonymous requests to be made specifically from the website. We desire a result of [AllowAnonymous] for any unauthorized website visitor. We do NOT want to allow requests from any program / client from the open internet for these calls.

Possible solutions

• Specific authorization policy that relies on a private header value
• Use CORS in some way to restrict which requests make it through. This is preferable as we already have a CORS policy, but we'll still have to get past the authorization middleware.

[hburn7]

Do we need to keep this open?

[myssto]

Do we need to keep this open?

Not sure... I think maybe it could be transferred to something in the post-beta release project. Simply put, since this is a public API, CORS is not a big concern. However in the future I would like to harden CORS on any non-client endpoints to only accept requests from web.