SignalR - CORS - Windows Authentication it fails to get past negotiate - NOT SOLVED - IT IS A BUG till MS SOLVES ISSUE!

Describe the bug

When trying to set up connection to Hub it always fails, HOWEVER all of the standard API controller calls work and negotiate just fine, it only fails when trying to connect to the Hub using this library that MS provides:

const newConnection = new HubConnectionBuilder() .withUrl(url, options => { options.UseDefaultCredentials = true options.Headers[‘Content-Type’] = ‘text/plain’ // options.SkipNegotiation = true; })
.withAutomaticReconnect() .build();

I have tried many different configurations of this call and still nothing.

Have added to web.config this did help a little, it at least lets me in, but still fails with exception below:

 <httpProtocol>
        <customHeaders>
          <add name="Access-Control-Allow-Origin" value="https://localhost:3000" />       
          <add name="Access-Control-Allow-Credentials" value="true" />
          <add name="Access-Control-Request-Headers" value="User-Agent,Content-Type,Authorization,X-RequestDigest,X-ClientService-ClientTag,XMLHttpRequest,x-requested-with" />
          <add name="Access-Control-Allow-Headers" value="User-Agent,Content-Type,Authorization,X-RequestDigest,X-ClientService-ClientTag,XMLHttpRequest,x-requested-with" />
          <add name="Access-Control-Request-Method" value="GET,POST,HEAD,OPTIONS" />
        </customHeaders>
      </httpProtocol>

Also tried custom middleware for CORS but still failing with or without it. Of course it is blocking the request before it gets to actual hub. Have tried skipping Negotiation, but that has not worked either. Get the same error on DEV box also, so it seems consistent with of course a different Access-Control-Allow-Origin.

Exceptions (if any)

Access to fetch at ‘https://localhost:44319/ticketsummary/negotiate?negotiateVersion=1’ from origin ‘https://localhost:3000’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: It does not have HTTP ok status.

Further technical details

dotnet core 3.1

• SSL enabled
• Win Auth enabled

SignalR reactJS

[BrennanConroy]

This is outside the scope of what we can support through GitHub. You can reach out to paid support at http://support.microsoft.com/supportforbusiness/productselection?sapId=ef53b119-5f8c-7343-2a0f-f5008a1399b9

[pthorsley]

The localSpecificOrigins is what is run when debugging, have removed serverSpecificOrigins just for this testing fix.

Might try out Socket.io , maybe it does not have this CORS, SignalR, Win Auth issue.

Here is the basic add CORS options:

public void ConfigureServices(IServiceCollection services)
       {
         
           services.AddSignalR();

           services.AddControllers();

           services.Configure<AppSettings>(Configuration);

           services.AddMemoryCache();

           services.Configure<IISOptions>(options => options.AutomaticAuthentication = true);

           services.AddScoped<SmtpClient>((serviceProvider) =>
           {
               var config = serviceProvider.GetRequiredService<IConfiguration>();
               return new SmtpClient()
               {
                   Host = config.GetValue<String>("EmailSettings:SMTP:Host"),
                   Port = config.GetValue<int>("EmailSettings:SMTP:Port"),
                   UseDefaultCredentials = false,
               };
           });
services.AddCors(options =>
           {
               options.AddPolicy(localSpecificOrigins,
               builder =>
               {
                   builder.WithOrigins("http://localhost:3000", "http://localhost:3001", "https://localhost:3000", "https://localhost:3001")
                   .AllowAnyHeader()
                   .AllowAnyMethod()
                   .AllowCredentials()
                   .SetIsOriginAllowed((host) => true) ;
               });

               options.AddPolicy(serverSpecificOrigins,
               builder =>              
               {
                   builder.WithOrigins("<server list removed for github>")
                   .AllowAnyHeader()
                   .AllowAnyMethod()
                   .AllowCredentials()
                   .SetIsOriginAllowed((host) => true);
               });
           });

       services.AddAuthentication(IISDefaults.Ntlm);
}