9

I am developing an application with ASP.NET Core 2.0 Web Api backend with Windows authentication and React frontend where I am experiencing that the first call to the API made from the frontend fails with no response (net::ERR_UNEXPECTED).

It seems to me that the 401 challenge response is not delivered or processed correctly by the browser.

This only happens when using Chrome on HTTPS. Using Edge or HTTP it works fine.

Subsequent calls after the first one works fine, and if I refresh the page manually, everything is working. But once I have closed down all Chrome windows and visit the page again, the first call always fails with the same error.

I've managed to reproduce the same behaviour in a fresh ASP.NET Core Web Api application with Windows authentication, where I enabled SSL and only added the following lines in Startup to enable Windows authentication;

services.Configure<IISOptions>(options => options.AutomaticAuthentication = true);
services.AddAuthentication(IISDefaults.AuthenticationScheme);

When accessing the api with the React frontend (with whatwg-fetch), the first call fails with net::ERR_UNEXPECTED.

When navigating to the api through Chrome, a quick flash of an error message can be seen before the page is redirected and shows the correct response.

When accessing the api through Postman, the first call results in a "Could not get any response" message. When trying again, it works. But when I close all Chrome and Postman windows and try again, the first call again shows the "Could not get any response" message.

Am I missing something, or is this some specific behaviour of Chrome?

I've tried hosting the API both in IIS and IIS Express, but there is no difference.

Avilan
  • 608
  • 2
  • 6
  • 23

2 Answers2

0

Run this chrome.exe --disable-site-isolation-trials --disable-web-security --user-data-dir="D:\temp"

Refer : Previous Post - Disable CORS in Chrome

Avantha Siriwardana
  • 172
  • 2
  • 7
0

because Windows Authentication isn't supported with HTTP/2. Authentication challenges can be sent on HTTP/2 responses, but the client must downgrade to HTTP/1.1 before authenticating take a look reference below: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-7.0&tabs=visual-studio

Use the below link to disable HTTP/2

https://help.goacoustic.com/hc/en-us/articles/360052067413-Disable-HTTP-2-in-IIS-10

mouris
  • 1
  • 1
  • 2
    Note that the linked content is not considered part of your answer here. Your answer without them might be perceived as lacking important details If you link please summarise not only what is achieved with the linked content, but also HOW it achieves it, i.e. a summary of the solution. – Yunnosch Feb 09 '23 at 14:23