You have to add Cors before MVC. The registration order of the middleware is important. If Cors is registered after mvc it will never be called. They are called in the order of registration.
Once cors process the request, it will pass it to next middleware (Mvc)