Can't load System.Web.Cors assembly after call to Microsoft.Owin.Cors

Question

When I check the System.Web.Cors assembly reference in the Solution Explorer, the Version is 5.2.3.0. The Specific Version property is set to False. The path is to the local project bin folder. When checking the .dll properties from the File Explorer, the file's product version and file version. is also 5.2.3.

My Web.config:

<dependentAssembly>
    <assemblyIdentity name="System.Web.Cors" publicKeyToken="31bf3856ad364e35" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
</dependentAssembly>

My packages.config (I think the troublesome assembly is Microsoft.AspNet.WebApi.Cors, but I included another one here with a similar name):

<package id="Microsoft.AspNet.Cors" version="5.2.3" targetFramework="net452" />
<package id="Microsoft.AspNet.WebApi.Cors" version="5.2.3" targetFramework="net452" />

Error is thrown on this line in Startup.cs

app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);

Here is the full error:

System.IO.FileLoadException was unhandled by user code
  FileName=System.Web.Cors, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
  FusionLog==== Pre-bind state information ===
LOG: DisplayName = System.Web.Cors, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
 (Fully-specified)
LOG: Appbase = file:///P:/project-z4a/project-z4a/
LOG: Initial PrivatePath = P:\project-z4a\project-z4a\bin
Calling assembly : Microsoft.Owin.Cors, Version=3.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35.
===
LOG: This bind starts in default load context.
LOG: Using application configuration file: P:\project-z4a\project-z4a\web.config
LOG: Using host configuration file: D:\Documents\IISExpress\config\aspnet.config
LOG: Using machine configuration file from C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config.
LOG: Post-policy reference: System.Web.Cors, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
LOG: Attempting download of new URL file:///C:/Users/*****/AppData/Local/Temp/Temporary ASP.NET Files/root/f8163156/5c96d267/System.Web.Cors.DLL.
LOG: Attempting download of new URL file:///C:/Users/*****/AppData/Local/Temp/Temporary ASP.NET Files/root/f8163156/5c96d267/System.Web.Cors/System.Web.Cors.DLL.
LOG: Attempting download of new URL file:///P:/project-z4a/project-z4a/bin/System.Web.Cors.DLL.
WRN: Comparing the assembly name resulted in the mismatch: Minor Version
ERR: Failed to complete setup of assembly (hr = 0x80131040). Probing terminated.

  HResult=-2146234304
  Message=Could not load file or assembly 'System.Web.Cors, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
  Source=Microsoft.Owin.Cors
  StackTrace:
       at Microsoft.Owin.Cors.CorsOptions.get_AllowAll()
       at z4a_dsa.Startup.Configuration(IAppBuilder app) in P:\project-z4a\project-z4a\Startup.cs:line 23
  InnerException: 

So, I can see it's expecting v5.0.0.0, but I can't see where where or why calling for this version.

I've done the following steps to debug this error. After each of the listed attempts, I cleaned, then rebuilt the project. The error hasn't changed after trying each of these steps.

• Update-Package
• Install-Package Microsoft.AspNet.WebApi.Cors
• Uninstall-Package Microsoft.AspNet.WebApi.Cors, then Install-Package Microsoft.AspNet.WebApi.Cors
• Uninstall-Package Microsoft.AspNet.WebApi.Cors, then Install-Package Microsoft.AspNet.WebApi.Cors -Version 5.2.3
• Downgraded Microsoft.AspNet.WebApi.Cors to v5.0.0.0 via the Package Manager Window.

I'm not an expert in .NET yet, and this is the 4th occurrence of the same exact error with a different assembly each time, since I started a fresh empty project with Web Api checked. And I installed the z4a-foundation-scaffold-auth package into my project. I would definitely appreciate some explanation of my gaps in knowledge here!

EDIT: Used ILDASM.exe to look at Microsoft.Owin.Cors assembly. Found it specified System.Web.Cors v5.0.0.0 in its manifest definition. I guess my question is now how to remedy this?

Answer 1

Turns out System.Web.Cors.dll does not come from the Microsoft.AspNet.WebApi.Cors package. It comes from the Microsoft.AspNet.Cors package.

Install-Package Microsoft.AspNet.Cors -Version 5.0.0

This resolved the immediate error.

In case you have a scenario in which you need two different versions of the System.Web.Cors.dll, I'd suggest this solution:

1. Using the Package Manager, change the version of Microsoft.AspNet.Cors to the version that Microsoft.Owin.Cors requests in its manifest definition.
2. Using the Developer Command Prompt for Visual Studio (run as admin), navigate to the package folder for the newly versioned Microsoft.AspNet.Cors where the *System.Web.Cors.dll** resides.
3. Run the following command: gacutil -i System.Web.Cors.dll.
4. Go back to the Package Manager and change Microsoft.AspNet.Cors back to the version you originally wanted.

This method simply pulls the desired version of the .dll file into your Solution's packages folder. Then you use gacutil.exe to add this version of the .dll to your Global Assembly Cache. Visual Studio probes for the desired .dll versions first in the GAC, then in your local project.