如何使用 Windows 身份验证在 IIS 上授权 CORS 预检请求 [英] How to authorize CORS preflight request on IIS with Windows Authentication

问题描述

我在 ASP.net Core 2(Windows 身份验证)上有一个 API，在 angular 上有一个前端.我进行了 cors 配置以从 SPA 角度查询我的后端，但由于预检而被阻止，因为他没有身份信息而被 IIS 服务器拒绝.

I have an API on ASP.net Core 2 (windows authentication) and a front on angular. I make a cors configuration to querying my backend from the SPA angular, but im blocked in cause of the preflight who are rejected from the IIS server because he don't have identification information.

错误信息:

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://XXXXXX' is therefore not allowed access. The response had HTTP status code 401.

代码正面:

//MY HEADER
private headers = new Headers({
    'Content-Type': 'application/json', 
    'Access-Control-Allow-Credentials':'true',
    'Access-Control-Allow-Origin':'true'
});

//REQUEST
let options = new RequestOptions({headers:this.headers, withCredentials:true});
return this.http.get(this.tasksUrl,options).map(res=>res.json());

代码背面:(Startup.cs)

code side back : (Startup.cs)

public void ConfigureServices(IServiceCollection services)
{
   services.AddCors();
   services.AddCors(options =>
   {
       options.AddPolicy("AllowSpecificOrigin",
            builder =>
            {
               builder.WithOrigins("http://theURLofTheFront:8080" )
               .AllowAnyMethod()
               .AllowAnyHeader()
               .AllowCredentials();
            });
   });
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();
        app.UseCors("AllowSpecificOrigin");
        app.UseMvc();
    }

我试试这个:

CORS 预检请求通过 Windows 身份验证返回 HTTP 401.

并且我添加了自定义标头以在 IIS 上指定访问控制允许来源"，这对我不起作用.

and i added custom header to specify the 'Acces-control-allow-origin' on IIS, dont work for me.

这对我不起作用:https://blogs.msdn.microsoft.com/friis/2017/11/24/putting-it-all-together-cors-tutorial/

我无法删除默认授权规则.

I can't remove the default authorization rule.

提前谢谢你

推荐答案

我用 IIS 模块 Cors 解决了我的问题

I solved my problem with the IIS module Cors

这篇关于如何使用 Windows 身份验证在 IIS 上授权 CORS 预检请求的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！