asp.net - Request ignored because of CORS in IdentityServer4

Question

I have 3 projects:

1. Client App
2. ASP.NET API App
3. IdentityServer4 MVC App

I am able to send a request from API to IDP but trying to send a request from Client to IDP yields

"CORS request made for path: /api/Trial/TrialAction from origin: https://localhost:44389 but
was ignored because path was not for an allowed IdentityServer CORS endpoint"

even though I added the following to the IDP:

services.AddCors(options =>
{
    options.AddPolicy("CorsPolicy", policyBuilder => policyBuilder
        .AllowAnyOrigin()
        .AllowAnyMethod()
        .AllowAnyHeader());
});

and

// ...
app.UseRouting();
app.UseIdentityServer();
app.UseCors("CorsPolicy");
app.UseAuthorization();
// ...

The interesting part is, I can send a request from API to IDP without adding CORS configuration to IDP. What am I doing wrong?

Config.cs:

public static class Config
{
    public static IEnumerable<IdentityResource> Ids =>
        new IdentityResource[]
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Profile(),
            new IdentityResources.Email(),
        };

    public static IEnumerable<ApiResource> Apis =>
        new ApiResource[]
        {
            new ApiResource("myapi", 
                "My API", 
                new [] { "membershipType" }
            )
        };

    public static IEnumerable<Client> Clients =>
        new Client[]
        { 
            new Client
            {
                ClientId = "mywebclient",
                ClientName = "My Web Client",
                AllowedGrantTypes = GrantTypes.Code, // Authorization code flow with PKCE protection
                RequireClientSecret = false, // Without client secret
                RequirePkce = true,
                RedirectUris = { "https://localhost:44389/authentication/login-callback" },
                PostLogoutRedirectUris = { "https://localhost:44389/authentication/logout-callback" },
                AllowedScopes = {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    IdentityServerConstants.StandardScopes.Email,
                    "albidersapi"
                },
                AllowedCorsOrigins = { "https://localhost:44389" },
                RequireConsent = false,
            }           
        };
}

Answer 1

do yo have the client and API in the same project as IdentityServer? I typically recommend that you keep them apart.

A wild guess could be to swap these two lines:

app.UseIdentityServer();
app.UseCors("CorsPolicy");

Because apparently IdentityServer captures the request to the API?