I have a .Net Core application running on an Azure App Service instance. The application is a WebAPI that also has a SignalR Hub. Both the backend and the hub are being consumed by a client hosted on Azure Static Web App.
Azure Static Web App automatically adds SSL certificate to the client, and Azure App Service automatically adds SSL certificate to the .Net application.
Client and backend communication work perfectly over SSL, but when attempting client communication with Hub SignalR returns the following error:
Access to fetch at ‘https://backend-service.azurewebsites.net/hub/shop/negotiate?negotiateVersion=1’ from origin ‘https://client-app.5.azurestaticapps.net’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: The value of the ‘Access-Control-Allow-Credentials’ header in the response is ” which must be ‘true’ when the request’s credentials mode is ‘include’.
The service was working fine until a few days ago when the error started to occur without having modified anything.
Solution:
In the Azure Web App configuration panel, go to the CORS blade (inside API group), and in the “Request Credentials” section enable the “Enable Access-Control-Allow-Credentials” option.
Possible causes:
- SignalR client configuration. When connecting to a hub, the use of credentials can be specified (withCredentials flag): /a/43606134/4374547
- Accept credentials in backend server CORS policies. .Net example: /a/43326801/4374547
In my case none of the above were valid solutions. Since the use of credentials is vital in my scenario, and my CORS policies were well configured. I can also assume that Azure Static Web App is adding an extra header on the requests.