How to serve static files (for CORS / OPTION request) in IIS?

Question

I have an AngularJS application that I am trying to use an AJAX request to pull in a static file from a ASP.NET WebApi2 application running on IIS 8.5. Similar to the example below-

ng-include="http://server/Content/icon.svg"

If I navigate to that URL in the browser, IIS happily serves that file as a static file. However, when I use an AJAX request, Angular attempts an OPTIONS request first, since it is CORS request, and IIS throws a 405 Method Not Allowed.

I have tried adding these headers to the static Content folder in the web site-

However this made no difference. Also, the IIS server does not have WebDAV installed, which is a thing I have seen around as something that could cause issues.

Answer 1

I had an IIS site with a virtual directory from which I serve my static files.

In order to do CORS from the browser, what I did was configuring the "En tetes de réponses HTTP" of the site, which in english should be something like "HTTP Response Headers".

There I added a new header named "Access-Control-Allow-Origin" with value "*".

From this moment, I can use static files in XHR.

My actual problem was serving OpenStreetMap tiles to a file:///c/xxx/index.html and the error in chrome was

Image from origin 'http://myhost' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

Answer 2

This works for me for accessing .png files in a subdirectory under forms authentication. You should be able to change the extension.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

  <system.web>
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>

  <system.webServer>
    <staticContent>
      <mimeMap fileExtension=".*" mimeType="image/png" />
    </staticContent>
    <handlers>
      <clear />
      <add name="StaticFile" path="*" verb="*" type="" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" scriptProcessor="" resourceType="Either" requireAccess="Read" allowPathInfo="false" preCondition="" responseBufferLimit="4194304" />
    </handlers>
  </system.webServer>

</configuration>

What if you add the OPTIONS as a verb for the Access-Control-Allow-Methods As answered in this question.

 <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" />
        <add name="Access-Control-Allow-Headers" value="Content-Type" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

Answer 3

If you want to serve static files to the public internet without any authorization you can set your CORS polity to:

• Allow GET request
• From any Origin
• Allow all request Headers
• Allow the OPTIONS reply to be cached for 24h

Internet Information Server this can be configured with the following IIS configuration for your site

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Access-Control-Allow-Methods" value="GET,OPTIONS" />
                <add name="Access-Control-Allow-Origin" value="*" />
                <add name="Access-Control-Allow-Headers" value="*" />
                <add name="Access-Control-Max-Age" value="86400" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>