18

We recently migrated an API application from Azure Cloud Services to Azure Websites, and some clients are still using our legacy protocol for authentication, which uses cookies (instead of the usual Authorization: Bearer HTTP header). We need to support this authentication protocol for a little longer as the clients will not be able to migrate right away.

To support cookies in a cross-origin ajax request directed to the API, the client needs to set the withCredentials setting to true in the XMLHttpRequest, and the server needs to repond with the Access-Control-Allow-Credentials header as well to any CORS request.

The problem we face is that the Azure Website manages CORS all by itself, and uses its own configuration (which is limited to a list of allowed origins) for the response, which does not allow this header to be set... thus breaking the application for all our Ajax clients!

Is there a way to (temporarily) add this header in the responses?

Maxime Rossini
  • 3,612
  • 4
  • 31
  • 47

3 Answers3

23

We finally managed to understand the behavior of the Azure Apps CORS middleware. To disable it, you have to clear every single allowed origin entry in the CORS blade of your web app (including *). Then you can manage CORS by yourself, either using the Web Api 2 functionality or using the web.config.

The information is even available in the documentation:

Don't try to use both Web API CORS and App Service CORS in one API app. App Service CORS will take precedence and Web API CORS will have no effect. For example, if you enable one origin domain in App Service, and enable all origin domains in your Web API code, your Azure API app will only accept calls from the domain you specified in Azure.

So the final answer is: If your application does not need a very specific CORS management, you can use Azure App Service CORS. Otherwise you will need to handle it yourself and disable all CORS configuration in the web app.

Maxime Rossini
  • 3,612
  • 4
  • 31
  • 47
  • Thank you! I've been having a lot of trouble using CORS in a servicestack App hosted on Azure. It turns out removing the CORS config from Azure portal fixed everything. – Chris W Nov 25 '16 at 08:23
  • 2
    Strange, it should have a toggle to disable Azure cors, simply removing all sites disables it and passes through to your app. If any origins are listed, it seems to remove any other CORS headers you have (withcredenetials, methods, etc.). I think some kind of explanation that entering a site would enable it and what values it would use for those other headers should be provided. I would think it should give some kind of error or warning for automatically removing your headers too... – Jason Goemaat Oct 08 '17 at 02:14
4

This is now supported in the Azure App Service CORS feature. Unfortunately there is not a UX for it yet, so it is a little painful to enable. There are currently two straightforward methods.

  1. On the Azure Portal, navigate to your Web App. Navigate to API > CORS. There is now a checkbox for Enable Access-Control-Allow-Credentials. Check this box and press Save.

  2. Use the Azure CLI with the following command:

az resource update --name web --resource-group myResourceGroup --namespace Microsoft.Web --resource-type config --parent sites/<app_name> --set properties.cors.supportCredentials=true --api-version 2015-06-01

You can see more documentation here.

NOTE: This does not work with * as an allowed origin. This is a security choice we decided to make.

Connor McMahon
  • 1,318
  • 7
  • 15
  • I can't find this option in the Portal but the Azure CLI option has resolved my issue. Thank you! – m1o2 Feb 18 '20 at 23:51
2

This is Something that you can do in the web.config file that is available in your web app.

You can edit it using Visual Studio Online (Monaco) which is a Tools that you add from the Azure Portal.

Read more here : http://enable-cors.org/server_iis7.html

Etienne Margraff
  • 701
  • 4
  • 7
  • I was sceptical about this method because I thought the Azure Website CORS middleware overwrote all CORS headers set by the hosted application to set its own, but I will try this anyway and let you know. – Maxime Rossini Apr 26 '16 at 09:48
  • 1
    This is what I thought, there is an Azure website middleware between the client and our application server that just drops all CORS-related headers set by the server and replaces them with its own, so adding a custom `Access-Control-Allow-Credentials` header in the web.config file has no effect. Any other custom header is properly added, but the CORS headers are not. – Maxime Rossini Apr 26 '16 at 11:11