CORS on asp.net core web api doesn't work after deploy on IIS

Question

I'm developing a net core webapi with an angular front end. When i was debugging everything works fine, now that i had deploying the web abi on IIS I can't make it works, it gives me CORS errors: "...No 'Access-Control-Allow-Origin' header is present on the requested resource."

here is the code to enable CORS on web api:

public void ConfigureServices(IServiceCollection services)
{
...
    services.AddCors();

...
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
...
    app.UseCors(x => x
        .AllowAnyOrigin()
        .AllowAnyMethod()
        .AllowAnyHeader());

I have try different solution i've found in this and other site, nothing seems to work

should i add some kind of header in my angular app? Could the problem be with IIS?

Answer 1

You might want to take a look at this.

In your Startup.cs file

// This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
           services.AddCors(cfg =>
           {
                cfg.AddDefaultPolicy(policy =>
                {
                     policy.WithOrigins("list of origins to allow here")
                     .AllowAnyHeader()
                     .AllowAnyMethod()
                     .AllowCredentials()
                     .SetIsOriginAllowed((_) => true)
                     .SetIsOriginAllowedToAllowWildcardSubdomains();
                });
           });


services.AddMvc()
                .AddJsonOptions(options =>
                {
                     options.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver();
                     options.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
                     options.SerializerSettings.PreserveReferencesHandling = PreserveReferencesHandling.Objects;
                })
                .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
      }


public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
      {
         app.UseCors();
         app.UseMvc(routes =>
           {
                routes.MapRoute(
                     name: "default",
                     template: "{controller=Home}/{action=Index}/{tag?}");
           });
      }

Do make sure Cors is called before the call to MVC.

I hope this helps.

Regards

Answer 2

I finally managed to solve the problem: I had enabled "Basic Authentication" on IIS because I mistakenly thought it was the right things to do.

I found that IIS "Basic authentication" is different from what I had implemented (I created a custom "BasicAuthenticationHandler" that read headers e validate users)

The problem was that IIS (or Angular, or Chrome, i don't know) instead of returning error "401 unauthorized" gave me CORS error even if "Anonymous authentication" was enabled (it's mandatory to disable all other authentications).