IIS CORS, on JavaScript fetch request - iis

Question

I have the CORS problem with axios or fetch with different configurations, these are my codes:
For fetch:
fetch(url, {
method: 'GET',
mode: 'cors',
headers: {
Authorization: token,
'Access-Control-Allow-Origin': '*'}
})
.then(response =>
response.ok ? response : Promise.reject<Response>(response)
)
.then(response => response.json())
.then(data => data.Token)
Or for axios
axios.get(url, {
headers: {
Authorization: token,
'Access-Control-Allow-Origin': '*'
},
crossDomain: true
})
.then((response) => {
console.log("sendValidateJWTRequest response", response);
return response.data
}, (error) => {
console.log(error);
return Promise.reject(error);
})
And in my web.config I have:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>
I'm still getting in the browser:
What else should I try?

Answer 1

As the comment posted by Lex Li, IIS CORS is a good choice to handle the CORS issue. some Preflighted requests can not be handled properly. In an Asp.net web application, we usually add a global.asax file to process it on the server-side.
protected void Application_BeginRequest(object sender, EventArgs e)
{
if (Request.Headers.AllKeys.Contains("Origin") && Request.HttpMethod == "OPTIONS")
{
Response.End();
}
}
However, IIS Core module is a better solution.
1. Install the IIS CORS module on the server-side.
https://www.iis.net/downloads/microsoft/iis-cors-module
2. Here is a common configuration allowing all requests from all origins.
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<directoryBrowse enabled="true"/>
<cors enabled="true" failUnlistedOrigins="true">
<add origin="*" allowed="true">
<allowHeaders allowAllRequestedHeaders="true"/>
</add>
</cors>
</system.webServer>
</configuration>
That’s all.
For customizing your configurations for a specific origin, please check the below link.
https://learn.microsoft.com/en-us/iis/extensions/cors-module/cors-module-configuration-reference
Feel free to let me know if there is anything I can help with.