c# - Cross Domain Request w/ Cors -


i've got ember solution, locally runs on http://localhost:4200. request data webapi application, utilizes windows authentication. runs on http://localhost:11470. bizarre reason when webapi application responds leaves off content such as: access-control-allow-origin. throwing following exception:

xmlhttprequest cannot load http://localhost:11470/api/authentication/logins. response preflight request doesn't pass access control check: no 'access-control-allow-origin' header present on requested resource. origin 'http://localhost:4200' therefore not allowed access. response had http status code 401.

if @ request, see webapi application isn't including such data in header. how can correct issue?

// inside: 'webapiconfig' configuration.enablecors(new enablecorsattribute("http://localhost:4200", "*", "*") { supportscredentials = true });  // controller: [route("api/authentication/logins")] public ihttpactionresult login() {      if (user.identity.isauthenticated)           return ok();             return unauthorized(); }  // ember ajax: ember.$.ajax({      type: "get",      url: 'http://localhost:11470/api/authentication/logins',      crossdomain: true,      headers:{           'authorization': 'www-authenticate'      },      xhrfields: {           withcredentials: true      },      error: function() { console.log('error'); },      success: function() { console.log('working?'); } }); 

i tried following:

  • forcing header information in web.config.
  • custom implementation of ihttpactionresult
  • custom filter implementation actionfilterattribute.

those don't hit before console errors. enabled webapi application windows authentication, if navigate directly localhost:11470/api/authentication/login prompts me active directory credentials, correctly responds.

i've read several documents, such as:

i can't solution reliably work, missing or not understanding? know requires header, why cors library webapi not sending it?

i've had exact same issue using microsoft.aspnet.webapi.cors package.

some things try checking in web api (some mentioned tried, i'm listing them details in tried anyway incase there difference in specifics):

  1. if api using login information need allow cors send "authentication" headers via supportscendentials property, should enabled like:

    config.enablecors(new enablecorsattribute("http://localhost:4200", "", "") { supportscredentials = true });

however solution didn't work me, didn't set cors header on /token options pre-flight, version difference library or webapi version.

  1. in web.config check if you're disabling options handler (i think default behavior), pre-flight trying call:

under system.webserver.handlers:

<!--<remove name="optionsverbhandler" />--> <!--allow options handling (preflight requests) removing line--> 
  1. force it: under system.webserver.httpprotocol add of these custom headers force them through (disabling other cors options if try this).
<customheaders>     <!--enable cors requests (todo fix this, move owin settings) -->     <add name="access-control-allow-origin" value="*" />     <add name="access-control-allow-headers" value="origin, content-type, authorization" />     <add name="access-control-allow-methods" value="get, post, options, put, delete" />   </customheaders> 

those changes allowed api respond correct headers, , recommend starting there.

  1. instead of using microsoft.aspnet.webapi.cors cors package , setting in webapiconfig.cs set directly on owin middlewhere in startup.cs or startup.auth.cs, , first line in either of these, before other owin pineline, add:

    app.usecors(microsoft.owin.cors.corsoptions.allowall);


Comments

Popular posts from this blog

authentication - Mongodb revoke acccess to connect test database -

r - Update two sets of radiobuttons reactively - shiny -

ios - Realm over CoreData should I use NSFetchedResultController or a Dictionary? -