UseCors must be called before UseResponseCaching

[lamLeX]

Describe the bug

According to https://docs.microsoft.com/en-us/aspnet/core/performance/caching/middleware?view=aspnetcore-5.0

Project template

Api 6.2.1

[lamLeX]

Also, in https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0#set-the-allowed-origins

Is there any specific reason why this template relaxes all CORS security feature?

[RehanSaeed]

Thanks for the bug. Looks like this is a recent change in documentation dotnet/aspnetcore#23218.

Fixed by #1111.

[RehanSaeed]

Regarding AllowAnyOrigin and AllowCredentials, we don't specify both together in the template. We only enable AllowAnyOrigin because this is a common thing to do. Since this is a template, it's up to the developer to extend as they wish. With that said, we could introduce more secure defaults. What do you suggest?