diff --git a/CorsClient/CorsClient/wwwroot/Index.html b/CorsClient/CorsClient/wwwroot/Index.html
index 38401b7..4c69ef0 100644
--- a/CorsClient/CorsClient/wwwroot/Index.html
+++ b/CorsClient/CorsClient/wwwroot/Index.html
@@ -2,7 +2,7 @@
 <html>
 <head>
     <meta charset="utf-8" />
-    <title>iFrame Tab Demo</title>
+    <title>CORS跨域 客户端</title>
     <script type="text/javascript" src="Scripts/jquery-1.10.2.js"></script>
     <script type="text/javascript" src="Scripts/jquery.cookie.js"></script>
     <script>
@@ -48,9 +48,9 @@
     <div id="MenuLinks">
         <ul>
             <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="http://localhost:5000/api/Test/Ping">简单API</li>
-            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="https://www.hao123.com">好123</li>
-            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="https://www.360.com">360</li>
-            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="https://www.qq.com">QQ</li>
+            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="http://localhost:5000/api/Cors/Ping">全局跨域策略</li>
+            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="http://localhost:5000/api/Cors/NoCors">不允许跨域</li>
+            <li method="GET" dataType="json" contentType="application/x-www-form-urlencoded" url="http://localhost:5000/api/Cors/HasCors">单独明确可以跨域</li>
         </ul>
     </div>
     <pre id="ContentBox">
diff --git a/CorsServer/CorsServer.WebApi31/Controllers/CorsController.cs b/CorsServer/CorsServer.WebApi31/Controllers/CorsController.cs
index 2e637d8..3d22b91 100644
--- a/CorsServer/CorsServer.WebApi31/Controllers/CorsController.cs
+++ b/CorsServer/CorsServer.WebApi31/Controllers/CorsController.cs
@@ -38,6 +38,7 @@ namespace CorsServer.WebApi31.Controllers
 
         [HttpGet]
         [HttpOptions]
+        [DisableCors]
         public IActionResult NoCors()
         {
             var data = new { Code = 0, Messge = "不允许跨域" };
diff --git a/CorsServer/CorsServer.WebApi31/Program.cs b/CorsServer/CorsServer.WebApi31/Program.cs
index d28175d..5579108 100644
--- a/CorsServer/CorsServer.WebApi31/Program.cs
+++ b/CorsServer/CorsServer.WebApi31/Program.cs
@@ -21,7 +21,8 @@ namespace CorsServer.WebApi31
             Host.CreateDefaultBuilder(args)
                 .ConfigureWebHostDefaults(webBuilder =>
                 {
-                    webBuilder.UseStartup<Startup>();
+                    webBuilder
+                    .UseStartup<Startup>();
                 });
     }
 }
diff --git a/CorsServer/CorsServer.WebApi31/Startup.cs b/CorsServer/CorsServer.WebApi31/Startup.cs
index dc5dab8..787a33e 100644
--- a/CorsServer/CorsServer.WebApi31/Startup.cs
+++ b/CorsServer/CorsServer.WebApi31/Startup.cs
@@ -25,13 +25,15 @@ namespace CorsServer.WebApi31
 
         public void ConfigureServices(IServiceCollection services)
         {
-            services.AddCors(setup => 
-            {
-                setup.AddPolicy(CorsName, build => 
-                {
-                    build.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().WithExposedHeaders("x-custom-error");
-                });
-            });
+            #region Config
+            services.Configure<CorsOption>();
+            #endregion
+            #region  CORS
+            AddCors_1(services);
+            //AddCors_2(services);
+            //AddCors_3(services);
+            //AddCors_4(services);
+            #endregion
             services.AddControllers();
         }
 
@@ -56,5 +58,60 @@ namespace CorsServer.WebApi31
                 endpoints.MapControllers();
             });
         }
+
+        private IServiceCollection AddCors_1(IServiceCollection services)
+        {
+            services.AddCors(setup =>
+            {
+                setup.AddPolicy(CorsName, build =>
+                {
+                    build
+                    .AllowAnyOrigin()
+                    .AllowAnyMethod()
+                    .AllowAnyHeader()
+                    .WithExposedHeaders("x-custom-error");
+                });
+            });
+
+            return services;
+        }
+
+        private IServiceCollection AddCors_2(IServiceCollection services)
+        {
+            services.AddCors(setup =>
+           {
+               setup.AddPolicy(CorsName, build =>
+               {
+                   build.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().WithExposedHeaders("x-custom-error");
+               });
+           });
+
+            return services;
+        }
+
+        private IServiceCollection AddCors_3(IServiceCollection services)
+        {
+            services.AddCors(setup =>
+           {
+               setup.AddPolicy(CorsName, build =>
+               {
+                   build.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().WithExposedHeaders("x-custom-error");
+               });
+           });
+
+            return services;
+        }
+
+        private IServiceCollection AddCors_4(IServiceCollection services)
+        {
+            services.AddCors(setup =>
+           {
+               setup.AddPolicy(CorsName, build =>
+               {
+                   build.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().WithExposedHeaders("x-custom-error");
+               });
+           });
+            return services;
+        }
     }
 }
diff --git a/CorsServer/CorsServer.WebApi31/appsettings.json b/CorsServer/CorsServer.WebApi31/appsettings.json
index 9c54377..68b53b6 100644
--- a/CorsServer/CorsServer.WebApi31/appsettings.json
+++ b/CorsServer/CorsServer.WebApi31/appsettings.json
@@ -1,5 +1,12 @@
 {
   "urls": "http://*:5000",
+  "CORS": {
+    "PolicyName": "",
+    "Origin": ["*"],
+    "Method": [ "*" ],
+    "Header": [ "*" ],
+    "ExposedHeaders": []
+  },
   "Logging": {
     "LogLevel": {
       "Default": "Information",
