Add warnings for CORS policies

src/OrchardCore.Modules/OrchardCore.Cors/Controllers/AdminController.cs

@@ -97,6 +97,11 @@ public async Task<ActionResult> IndexPOST()
 
             var corsPolicies = new List<CorsPolicySetting>();
 
+            //For each policy check the following validation rule :
+            //If allow origin and allow credentials are both true create a warning message that cors will not work .
+            //Warn user.
+            var policyWarnings = new List<string>();
+
             foreach (var settingViewModel in model.Policies)
             {
                 corsPolicies.Add(new CorsPolicySetting
@@ -112,8 +117,11 @@ public async Task<ActionResult> IndexPOST()
                     IsDefaultPolicy = settingViewModel.IsDefaultPolicy
 
                 });
+                if (settingViewModel.AllowAnyOrigin && settingViewModel.AllowCredentials)
+                {
+                    policyWarnings.Add($"{settingViewModel.Name}");
+                }
             }
-
             var corsSettings = new CorsSettings()
             {
                 Policies = corsPolicies
@@ -124,6 +132,14 @@ public async Task<ActionResult> IndexPOST()
             await _shellHost.ReleaseShellContextAsync(_shellSettings);
 
             await _notifier.SuccessAsync(H["The CORS settings have updated successfully."]);
+            if (policyWarnings.Any())
+            {
+                var warning1 =  "Specifying AllowAnyOrigin and AllowCredentials is an insecure configuration and can result in cross-site request forgery. The CORS service returns an invalid CORS response when an app is configured with both methods.";
+                var warning2 = "<strong>Affected policies: " + string.Join(", ", policyWarnings) + "</strong>";
+                var warning3 =  "Refer to docs:<a href='https://learn.microsoft.com/en-us/aspnet/core/security/cors' target='_blank'>https://learn.microsoft.com/en-us/aspnet/core/security/cors</a>";
+                var allWarnings = $"{warning1}<br />{warning2}<br />{warning3}";
+                await _notifier.WarningAsync(H[allWarnings]);
+            }
 
             return View(model);
         }