API App - CORS problem with SignalR

Question

Hey, didn't found any API App forum so i'm asking here.

I've Api App that connecting with SignalR to a Web App both on azure with different domains.

I've updated the MS_CrossDomainOrigins in my Api App to allow the DNS of the Web App. All the requests are ok, except the SignalR requests, where I'm getting -

"Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials."

It's important to say that when I run my Api and Web App locally ( also with different domains) it's working fine.

also, I'm using the Owin startup file, startup.cs, that telling the SignalR to allow CORS, maybe the azure WebApp doesn't know how to run it?

Answer 1

Hi,

I would suggest you to check this link if you have missed any thing.

Using SignalR with Web Apps in Azure App Service:

http://www.asp.net/signalr/overview/deployment/using-signalr-with-azure-web-sites

Regards,
Azam khan

Answer 2

Hey Azam, My problem is with the Api App, if I'm deploying on azure web sites the SignalR is working well with CORS.

Answer 3

Hi,

Please refer this link and check if it helps:

http://stackoverflow.com/questions/28624724/cross-origin-signalr-connection-stops-after-negotiate

Regards,
Azam khan

Answer 4

Hi shacharle,

    I am also finding the same problem. During tests the web api works ok with the correct headers on the response. The moment is deployed to azure api app, the header for 'Access-Control-Allow-Credentials'   is no longer there.  How did you resolve this problem?

  I did check the accepted answer, but the information there does not provide me with a resolution.

thanks.

---

og-bit.com

Answer 5

In my case, the AJAX request was sending the following field:

  xhrFields: {
                    withCredentials: true
      },

This causes the browser to expect the Access-Control-Allow-Credentials header = true back. I removed the parameter from the request, and the response was 200 with a valid token for subsequent calls. There is no need to add that parameter in my case because we already provide the Authorization header with the necessary information.

More information can be found here: http://www.ozkary.com/2015/12/api-oauth-token-access-control-allow-credentials.html

hope it helps others.

---

og-bit.com