The error message you are encountering is related to the Content Security Policy (CSP) settings that are most likely configured in the HTTP response headers of your API. CSP is a security measure designed to prevent various attacks, such as Cross-Site Scripting (XSS), by defining which content can be loaded by the browser.

To address this issue, consider modifying your CSP headers. The error suggests that the default-src 'none' directive is preventing any resource loading by default, and since connect-src is not specified, it defaults to the general policy.

Your Cross-Origin Resource Sharing (CORS) setup appears to be correct and should permit requests from any origin. To ensure it's properly implemented, make sure to position app.UseCors() after the builder.Build() call and before defining any endpoints (like app.MapControllers()). The sequence of middleware is crucial in .NET Core applications.

Verify that the URL in your fetch request matches the case of your endpoint path as specified in the API. .NET Core routing can be case-sensitive, particularly on some servers such as Kestrel.

Additionally, note that browsers may cache CSP headers. Clear your browser cache or try testing in a private browsing window.