cors error in authentication type windows - visual studio 2019

Question

I started a .NET CORE 5 project

And I chose windows type authentication

type authentication image

And this type of project gives me a CORS error on the client side (react)

But if instead of windows I choose none, I won't get an error

This is the call from the client side:

const res = await fetch(`https://localhost:44373/weatherforecast`)

I need this type of project because I want to use AD authentication

I tried adding it to the fetch call:

const res = await fetch(`https://localhost:44300/weatherforecast`,{credentials: 'include'})

and change the STARTUP:

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace WebApplication3
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to 
add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllers();
            services.AddCors(options =>
            {
                options.AddPolicy("MyMyAllowCredentialsPolicy",
                    policy =>
                    {
                        policy.WithOrigins("https://localhost:44300")
                               .AllowCredentials();
                    });
            });
        }

        // This method gets called by the runtime. Use this method to 
configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, 
IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseCors();

            app.UseRouting();

             app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

Answer 1

I also created a new .net 6 web api project with windows authentication. I also had a front end project.

This is my code and it worked for me. In my Program.cs , I added Cors policy and others are generated by default.

using Microsoft.AspNetCore.Authentication.Negotiate;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCors(options =>
{
    options.AddPolicy("mypolicy",
        policy =>
        {
            policy.WithOrigins("http://localhost:8848").AllowCredentials();
                   //.AllowCredentials();
        });
});
// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();


builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
   .AddNegotiate();

builder.Services.AddAuthorization(options =>
{
    // By default, all incoming requests will be authorized according to the default policy.
    options.FallbackPolicy = options.DefaultPolicy;
});

var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
app.UseHttpsRedirection();
app.UseCors("mypolicy");
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();

And I used ajax to send the request, missing withCredentials will lead to 401 error:

$("#btn2").click(function(event) {
                $.ajax({
                    url: "https://localhost:7272/WeatherForecast",
                    type: "get",
                    xhrFields: {
                        withCredentials: true
                    },
                    success: function(data) {
                        alert(data);
                        console.info(data);
                    }
                })
            });

Another point which needs to notice is that, when opening the client website in the private mode, it will still meet 401 while everything worked well when open the website in the normal window. That is because private mode doesn't contain auth information I think.