diff --git a/src/YhCore.WebApi/Controllers/Api/Com/LogController.cs b/src/YhCore.WebApi/Controllers/Api/Com/LogController.cs
index 0026fb7..ac2ef40 100644
--- a/src/YhCore.WebApi/Controllers/Api/Com/LogController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Com/LogController.cs
@@ -1,4 +1,5 @@
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using YhCore.Common;
 using YhCore.Common.UserContext;
@@ -13,6 +14,7 @@ namespace YhCore.WebApi.Controllers.Api
     /// </summary>
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/log")]
+    [EnableCors("default")]
     public class LogController : ControllerBase
     {
         private readonly ILogService _logService;
diff --git a/src/YhCore.WebApi/Controllers/Api/Com/SchClassController.cs b/src/YhCore.WebApi/Controllers/Api/Com/SchClassController.cs
index 572cb52..239bc0b 100644
--- a/src/YhCore.WebApi/Controllers/Api/Com/SchClassController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Com/SchClassController.cs
@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Text.Json;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.SchClass.OpenApi;
 using Yh.SchClass.OpenApi.Model;
@@ -15,6 +16,7 @@ namespace YhCore.WebApi.Controllers.Api
     /// 对应 Java 教务 bschclassmanage 的 /oapi 端点（配置节 yh:schclass:open）。
     /// <para>SDK 门面 <see cref="SchClassOpenApi"/> 聚合 10 个客户端，本控制器演示其中 5 个。</para>
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/com/schClass")]
     public class SchClassController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/Com/UserController.cs b/src/YhCore.WebApi/Controllers/Api/Com/UserController.cs
index 0ba0061..e28a2f1 100644
--- a/src/YhCore.WebApi/Controllers/Api/Com/UserController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Com/UserController.cs
@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -15,6 +16,7 @@ namespace YhCore.WebApi.Controllers.Api
     /// <summary>
     /// 用户基础接口（对应 Java 版 controller/api/UserController，路由 /api/base/）。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/base")]
     public class UserController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/Common/CommonController.cs b/src/YhCore.WebApi/Controllers/Api/Common/CommonController.cs
index 0e23bfd..7ae60a4 100644
--- a/src/YhCore.WebApi/Controllers/Api/Common/CommonController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Common/CommonController.cs
@@ -4,6 +4,7 @@ using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.Platform.Abstractions;
 using YhCore.Common;
@@ -20,6 +21,7 @@ namespace YhCore.WebApi.Controllers.Api.Common
     /// 字典部分 8 接口 + 文件部分 4 接口（FileDown / FilePreview / FileUpload / FileUploadImage）已落地；
     /// 旧 [NoAuth] 语义：无需用户上下文，schId 由前端传入或取当前用户。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/base")]
     public class CommonController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/Common/FreeApproveController.cs b/src/YhCore.WebApi/Controllers/Api/Common/FreeApproveController.cs
index b0b231e..052f91d 100644
--- a/src/YhCore.WebApi/Controllers/Api/Common/FreeApproveController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Common/FreeApproveController.cs
@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using YhCore.Common;
 using YhCore.Common.UserContext;
@@ -12,6 +13,7 @@ namespace YhCore.WebApi.Controllers.Api.Common
     /// 自由审批流控制器（对应旧 Areas/Common/FreeApproveController，路由 api/common/freeapprove）。
     /// 7 接口：自由流程节点查询/保存、审核意见、审核回显、抄送人。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/common/freeapprove")]
     public class FreeApproveController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/Common/ReviewprocessController.cs b/src/YhCore.WebApi/Controllers/Api/Common/ReviewprocessController.cs
index 67c4587..3c0d5c2 100644
--- a/src/YhCore.WebApi/Controllers/Api/Common/ReviewprocessController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/Common/ReviewprocessController.cs
@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.SchClass.OpenApi.Model;
 using YhCore.Common;
@@ -15,6 +16,7 @@ namespace YhCore.WebApi.Controllers.Api.Common
     /// 审核流程管理控制器（对应旧 Areas/Common/reviewprocessController，路由 api/common/reviewprocess）。
     /// 23 接口：流程/步骤 CRUD、教师查询、流程判断、用户角色。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/common/reviewprocess")]
     public class ReviewprocessController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/DocPrint/DocPrintStatisticsController.cs b/src/YhCore.WebApi/Controllers/Api/DocPrint/DocPrintStatisticsController.cs
index a268372..3a506fc 100644
--- a/src/YhCore.WebApi/Controllers/Api/DocPrint/DocPrintStatisticsController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/DocPrint/DocPrintStatisticsController.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.Platform.Abstractions;
 using YhCore.Common;
@@ -13,6 +14,7 @@ namespace YhCore.WebApi.Controllers.Api.DocPrint
     /// 旧类级 [NoAuth]：schId 由前端传入（非当前用户），新项目 SSO 关闭时匿名放行、开启时按配置保护，
     /// 语义一致。ExportRecord（Excel 导出，NPOI）延后迁移。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/docprint/statistics")]
     public class DocPrintStatisticsController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/DocPrint/LoadingController.cs b/src/YhCore.WebApi/Controllers/Api/DocPrint/LoadingController.cs
index b269f13..c49af3e 100644
--- a/src/YhCore.WebApi/Controllers/Api/DocPrint/LoadingController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/DocPrint/LoadingController.cs
@@ -1,4 +1,5 @@
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using YhCore.Common;
 using YhCore.Entity;
@@ -11,6 +12,7 @@ namespace YhCore.WebApi.Controllers.Api.DocPrint
     /// 无业务逻辑：执行一次 Base_Log 查询触发数据库连接建立，防止首请求慢。
     /// 旧接口 void 无返回体；新项目由 GlobalWrapResultFilter 统一包装为 {code:0,msg:"",data:null}。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/docprint/loading")]
     public class LoadingController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/DocPrint/WYSHRoleController.cs b/src/YhCore.WebApi/Controllers/Api/DocPrint/WYSHRoleController.cs
index 4ce3093..f80ebb9 100644
--- a/src/YhCore.WebApi/Controllers/Api/DocPrint/WYSHRoleController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/DocPrint/WYSHRoleController.cs
@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.Platform.Abstractions;
 using YhCore.Common;
@@ -17,6 +18,7 @@ namespace YhCore.WebApi.Controllers.Api.DocPrint
     /// 45 action 中本批落地 39 个；Excel 导入导出（ExceltotalListSHRole/WYRDExceldaochu/UpfileExcelSHRole/
     /// downMBOfSHRole/downUpfileSHRoleFK）与审批单 PDF（DwonWYSQD）依赖 NPOI/PdfHelper，延后迁移。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/docprint/wyshrole")]
     public class WYSHRoleController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/DocPrint/WY_listController.cs b/src/YhCore.WebApi/Controllers/Api/DocPrint/WY_listController.cs
index 8d2b787..32a9747 100644
--- a/src/YhCore.WebApi/Controllers/Api/DocPrint/WY_listController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/DocPrint/WY_listController.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Linq;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using Yh.Platform.Abstractions;
 using YhCore.Common;
@@ -16,6 +17,7 @@ namespace YhCore.WebApi.Controllers.Api.DocPrint
     /// 第一批：分类 / 版面 / 字典 14 接口；第三批 D1：文印 CRUD / 列表 / 审核 / 统计 / 指派 24 接口；
     /// Excel 导出 4 接口延后批次迁移。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath + "/docprint/wy_list")]
     public class WY_listController : ControllerBase
diff --git a/src/YhCore.WebApi/Controllers/Api/LoginUserController.cs b/src/YhCore.WebApi/Controllers/Api/LoginUserController.cs
index 4ca95d5..edc3915 100644
--- a/src/YhCore.WebApi/Controllers/Api/LoginUserController.cs
+++ b/src/YhCore.WebApi/Controllers/Api/LoginUserController.cs
@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -16,6 +17,7 @@ namespace YhCore.WebApi.Controllers.Api
     /// 登录用户接口（对应 Java 版 controller/api/LoginUserController，路由 /api/GetUserMod 等）。
     /// 注意：Java 版路由以大写开头（GetUserMod / GetUserInfo / Logout），此处保持 URL 大小写一致。
     /// </summary>
+    [EnableCors("default")]
     [ApiController]
     [Route(ApiRoutes.ApiPath)]
     public class LoginUserController : ControllerBase