IdentityServer4 - "path was not for an allowed IdentityServer CORS endpoint"

Question

I have a .netcore 3.1 MVC project that is using IdentityServer4 hybrid flow.

The identityServer has an AuthenticationProperties with ExpiresUtcset (1 hour).

On the MVC client, there's a cookie with SlidingExpiration (false) and ExpireTimeSpan (15 minutest).

After logging in to the application, the application cookie shows that it has an expiry of 1 hour. If I refresh or change to another page within the application, the application cookie gets the expiry extended. So far, this are all working as expected.

However, things get hairy if I try to do ajax calls on a page. If I stay on a page for a while (more than 15 minutes) without refreshing, the ajax calls fail with a Http error 0. When looking through the IdentityServer logs, it shows:

CORS request made for path: /connect/authorize from origin: http://localhost:5100 but was ignored because path was not for an allowed IdentityServer CORS endpoint

No CORS policy found for the specified request.

To deal with that, the following was added in the startup.cs ConfigureServices for the identityServer.

    var cors = new DefaultCorsPolicyService(log)
    {
        AllowAll = true
    };

    services.AddSingleton<ICorsPolicyService>(cors);

    services.AddCors(options =>
    {
        options.AddDefaultPolicy(builder =>
        {
            builder.WithOrigins("http://localhost:5100")
            .AllowAnyHeader()
            .AllowAnyMethod();
        });
    });

In configure, app.UseCors() was added.

However the same error messages in IdentityServer still comes up.

Has anyone faced similar issues, or know what I'm doing wrongly?

@Monkey I suggest to try couple of things: 1. try to add name for the policy 2. Add AllowCredentials 3. make sure app.UseCors("default") is listed before app.UseAuthentication() - here is another post with code sample stackoverflow.com/questions/61809873/identityserver4-spa-login/… — nahidf

LalitaCode LalitaCode · Accepted Answer · 2020-05-21T16:45:30

You also may need to add CORS in your client settings. See this. You have to add your URL in AllowedCorsOrigins settings for your client.

IdentityServer4 - "path was not for an allowed IdentityServer CORS endpoint"

2 Answers