.cs

    public class CorsPolicyAccessor : ICorsPolicyProvider
    {
        private readonly CorsOptions _options;
        public CorsPolicyAccessor(IOptions<CorsOptions> options)
        {
            if (options == null){throw new ArgumentNullException(nameof(options));}

            _options = options.Value;
        }
        public Task<CorsPolicy> GetPolicyAsync(HttpContext context, string policyName)
        {
            //verifica di non averlo già in CorsPolicy

            CorsPolicy cp = _options.GetPolicy(policyName);
            var origin = context.Request.Headers["Origin"].ToString();
            string result = cp.Origins.FirstOrDefault(x => x == origin);
           if (result == null)
            {
                if (...) //verifica dominio e se valido lo inserisce in CorsPolicy
                {
                    cp.Origins.Add(origin);
                }
            }
            cp.SupportsCredentials = true;
            return Task.FromResult(cp);
        }
    } 

            services.AddCors(o =>
            {
                o.AddPolicy("AllowXYZ", builder =>
                {
                    builder.AllowMethod(...)...;
                });

            }).AddTransient<ICorsPolicyProvider, CorsPolicyAccessor>();

    [EnableCors("AllowXYZ")]
    [Route("api/[controller]")]
    public class ... {}