CORS error on ajax getting redirected to ADFS STS server

Question

I'm having a CORS issue on our MVC Razor web site and our STS server.

MVC Site Info:

• Windows Server 2019
• IIS 10.0
• MVC 5
• Razor 3

General Info:

Normally, when a user navigates to one of our MVC web sites, they are redirected to the ADFS STS server to log in with their domain login. After a successful authentication, they get sent back to the site and are able to navigate freely. After an hour goes by, the next request back to the site briefly redirects them back to the ADFS server and then returns to the page they were navigating to. This happens without requiring them to manually log in again.

This is the beginning of the ADFS site's URL: https://sts.ourdomain.com/adfs/ls/?wtrealm=stuff_stuff_andmorestuff.. .

While the issue I am having is on a new MVC site, it also exists on a couple other MVC sites of ours that are using the same version of MVC and Razor, but are hosted on older versions of Windows Server and IIS. These sites also use the same ADFS STS server for AD authentication.

The Issue:

If the user is on a page on one of the MVC sites, ajax calls normally work fine. If, however, it has been over an hour since the last STS token was retrieved and an event fires that makes an ajax call, a redirect happens to the ADFS server during the ajax call, which causes a CORS error like this:

Access to XMLHttpRequest at 'https://sts.ourdomain.com/adfs/ls/?wtrealm=stuff_stuff_andmorestuff...'
(redirected from 'https://OurMVCSite.ourdomain.com/ControllerName/ActionName') from origin 
'https://OurMVCSite.ourdomain.com' has been blocked by CORS policy: Response to preflight request doesn't 
pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

If I understand this correctly, because of CORS policies, it is the ADFS server that needs to add an exception to the header to allow the javascript on our MVC sites to get redirected to them from a javascript ajax call. Is this correct?

Another department manages the ADFS server so I want to make sure the change needs to be made there before involving them.

Answer 1

Your proposed solution will not work either. Even if the CORS is working correctly, you will not be redirected. The ajax call will be, and then you'll just get the data from the new page as an XHR payload.

This would work in case you the second redirect would return the proper data for you: How to overcome CORS redirect issue while performing post operation via ajax?

There are workarounds for this, namely the suggestions mentioned here: How to manage a redirect request after a jQuery Ajax call