Add docs for applying CORS to SignalR hubs without global middleware

[Copilot]

Fixes #12918 . Addressing really old backlog issues, a few a sprint per org goals. This one is terribly old but still a gap in the docs today.

Users need to apply CORS policies specifically to SignalR hub endpoints without enabling CORS globally via UseCors middleware. This is common when different parts of an app require different CORS configurations.

Adds a new "Apply a CORS policy to SignalR hub endpoints" subsection documenting two approaches:

// Option 1: RequireCors on endpoint mapping
app.MapHub<ChatHub>("/chatHub")
    .RequireCors("SignalRPolicy");

// Option 2: [EnableCors] attribute on Hub class
[EnableCors("SignalRPolicy")]
public class ChatHub : Hub { }

• security.md — aspnetcore 8.0+ inline moniker only

Per reviewer feedback from @BrennanConroy, changes are scoped to supported versions only (8.0+). The unsupported-version includes (security7.md, security6.md, security2.1-5.md) are left unchanged.

Cross-references the existing Enable CORS with endpoint routing section.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/signalr/security.md	Security considerations in ASP.NET Core SignalR

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/signalr/security.md	aspnetcore/signalr/security

[wadepickett]

@copilot , The "SignalRPolicy" policy name used in code samples isn't defined anywhere in the preceding examples for any version. A brief note or example showing the named policy registration (like BrennanConroy's AddPolicy snippet) would improve clarity. See discussion comment from BrennanConroy on the original issue this PR is for here: #12918

[Copilot]

@copilot , The "SignalRPolicy" policy name used in code samples isn't defined anywhere in the preceding examples for any version. A brief note or example showing the named policy registration (like Br...

Added the AddCors/AddPolicy registration snippet that defines the "SignalRPolicy" name before it's used in the RequireCors and [EnableCors] examples. The 8.0+, 7.0, and 6.0 versions use builder.Services.AddCors(...) (minimal hosting), while the 3.0–5.x version uses the Startup.ConfigureServices pattern. See commit 7a6d503.

[Copilot]

Pull request overview

Adds documentation to the SignalR security guidance showing how to apply a named CORS policy specifically to SignalR hub endpoints (instead of applying a single CORS policy globally), across ASP.NET Core versioned content.

Changes:

• Add a new “Apply a CORS policy to SignalR hub endpoints” subsection with RequireCors and [EnableCors] approaches across 6.0/7.0/8.0+ and 3.0–5.x content.
• Update aspnetcore/signalr/security.md front matter (adds ai-usage, updates ms.date) and include the new subsection for 8.0+.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
aspnetcore/signalr/security.md	Adds the new per-hub CORS subsection for 8.0+ and updates article metadata.
aspnetcore/signalr/security/includes/security7.md	Adds the new per-hub CORS subsection for the 7.0 view.
aspnetcore/signalr/security/includes/security6.md	Adds the new per-hub CORS subsection for the 6.0 view.
aspnetcore/signalr/security/includes/security2.1-5.md	Adds the new per-hub CORS subsection for 3.0–5.x content (endpoint routing style).

[wadepickett]

Approved.

[wadepickett]

@copilot, revert all changes to these files:

aspnetcore/signalr/security/includes/security2.1-5.md
aspnetcore/signalr/security/includes/security6.md
aspnetcore/signalr/security/includes/security7.md

[Copilot]

@copilot, revert all changes to these files:

aspnetcore/signalr/security/includes/security2.1-5.md
...

Reverted all changes to those three files in 71e20c4. The CORS subsection is now only in security.md (aspnetcore 8.0+).

[wadepickett]

Removed the update from the non-supported versions of the article.