Disable CORS middleware of Azure app service

Question

I wrote some code to handle CORS into my Web Api(.Net Core). These code perfectly works on my local and test server(Azure app service) but it is not working on production(Azure app service). It gives error-

XMLHttpRequest cannot load http://myapiproduction.co/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://myuidashboard.co' is therefore not allowed access.

I gave correct allowed origin url in appsettings.Production.json. I removed all value (*) from CORS section of Azure app service(Production env).

When we removed every thing from CORS section of app service then our code logic should work because at a time only one middleware will work either app service's CORS middleware or our Web Api code logic.

Web Api (Startup.cs)-

var allowedOriginsArr = Configuration["AppSettings:AllowedOrigins"].Split(','); //Example- "http://myuidashboard.co"
services.AddCors(options =>
{
  options.AddPolicy("AllowAllCorsPolicy",
    builder => builder.WithOrigins(allowedOriginsArr)
               .WithMethods("GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS")
               .AllowAnyHeader()
               .WithExposedHeaders("X-Auth-Token")
               .AllowCredentials());
});

So, my question is - Is there any other setting i have to do to disable CORS middleware of Azure app service? I want to control CORS completely by code (Api logic).

Answer 1

I don't think there is any extra setting to disable it explicitly from Azure App Service side. Microsoft itself recommend to use your CORS utilities instead of inbuilt one - Refer Here.

Note Provided by Doc -

Don't try to use App Service CORS and your own CORS code together. When used together, App Service CORS takes precedence and your own CORS code has no effect.

Answer 2

Try to check the deployed appsettings.json in the associated appservice using Kudu or command line. Might be the appsettings isn't being applied.

Associated App Service > Under the Development Tools > Advanced Tools (Kudu)

Associated App Service > Under the Development Tools > Console

Answer 3

My azure site is programmed in vb.net, but ultimately I had to do this and then it worked:

Dim strMethod As String 

strMethod = Request.HttpMethod.ToUpper

If InStr(strMethod, "OPTIONS") Then

   Response.Flush()

End If