0

I need windows authentication in my project, but post-request is broken. I have a global implementation of HttpInterceptor.

Cors enabled in my backend.

services.AddCors(options => options.AddPolicy("AllowAllOrigin", builder => builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().AllowCredentials()))

When i send get-request i retrieve user identity in backend and it's alright. What's wrong with post-request?

OPTIONS http://localhost:56789/api/document/GetDocuments 401 (Unauthorized)
Failed to load http://localhost:56789/api/document/GetDocuments: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access. The response had HTTP status code 401.

P.S. When i setted anonymous authentication all get/post requests work, but i do not have user identity

Environment

Angular version: ^5.1.0-beta.1
Angular-cli version: ^1.6.0-beta.2 

Browser:
- [ x ] Chrome (desktop) version 62.0.3202.94

For Tooling issues:
- Node version: XX  8.8.1
- Platform:  Windows

My frontend service:

@Injectable()
export class DocumentService {
    controllerName: string = 'document';
    constructor(private http: HttpClient, @Inject('API_URL') private apiUrl: string) { }

    getDocuments(view: AppModels.View.BaseView): rx.Observable<AppModels.Document.DocumentList> {        
        return this.http.post<AppModels.Document.DocumentList>(`${this.apiUrl}/${this.controllerName}/GetDocuments`, view);
    }
}

My HttpInterceptor:

@Injectable()
export class AuthHttpInterceptor implements HttpInterceptor {
    intercept(req: HttpRequest, next: HttpHandler): rx.Observable<HttpEvent> {
        const headers = {};
        const clone = req.clone({ setHeaders: headers, withCredentials: true })
        return next.handle(clone);
    }
}
Андрей Сартаков
  • 1
  • 3

1 Answers1

2

Try enabling both Anonymous and Windows Authentication and set the [Authorize] attribute on your controller. I believe the 401 Unauthorized response is caused by enabling CORS, and is a result of the preflight header not containing an authentication token.

An alternative would be to change your http POST to a 'simple request' which limits Content-Type values to:

  • application/x-www-form-urlencoded
  • multipart/form-data
  • text/plain

'simple requests' do not trigger a CORS preflight. See https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS for details on the CORS specification.

scotty3
  • 141
  • 7