CORS problems in WebAPI hosted in IIS

iis asp.net-web-api cors preflight
RonnBlack picture RonnBlack · Apr 20, 2016 · Viewed 7.8k times · Source

I'm trying to implement an application that uses the same Token Based Authentication mechanism demonstrated in this really awesome example by Taiseer Joudeh.

In my application I kept encountering Cors problems. In some configurations I would get a 500 error on the Preflight (OPTIONS) request for the POST to get the token or I could get the token but then get a 404 error on the preflight request for the GET request to the actual API call with the Bearer token.

One difference was that Taiseer's code was setup to host in IISExpress (or Azure) and mine is hosted on Local IIS (running on Windows 7 at the moment).

On a hunch I tried hosting his API under Local IIS and I found the exact same problem. (500 error on the preflight request for the token and it looks like the actual API will work properly)

From what I've been reading it seems like this may be some conflict between the modules and handlers in IIS and the Cors implementation in WebApi but Taiseer's implementation works when hosted in Azure so perhaps it is a difference in the version of IIS (I'm currently running under Windows 7).

How can I sort out what is causing the problem?

Answer

Hypnobrew picture Hypnobrew · Apr 20, 2016

It is not the IdentityServer you are using but it could be the same problem. Regarding to the IdentityServer´s Github page you have to activate RAMMFAR (runAllManagedModulesForAllRequests) for your application when running under the IIS.

<system.webServer>
  <modules runAllManagedModulesForAllRequests="true">
  </modules>
</system.webServer>

Related questions

HTTP Error 500.19 and error code : 0x80070021

I have a simple webAPI build by Visual Studio 2013. It works well when I run it from VS13 but when I copy the project in local IIS it gives me the following error. HTTP Error 500.19 - Internal Server Error The …

Read More
ASP.NET Web API - PUT & DELETE Verbs Not Allowed - IIS 8

I recently upgraded from Visual Studio 2010 to the Visual Studio 2012 RC. The installer also installs IIS 8 Express which Visual Studio now uses as the default web server. IIS 8 is blocking my WEB API requests that use PUT AND DELETE verbs. …

Read More
Asp.NET Web API - 405 - HTTP verb used to access this page is not allowed - how to set handler mappings

I wrote REST service using ASP.NET Web API. I'm trying to send HttpDelete request, however I get the following error: 405 - HTTP verb used to access this page is not allowed I think I'm close to the solution, I …

Read More