Asp.NET Web API and SignalR Cors

Question

I am developing a DevExtreme project and I am using Web API and SignalR. I have two projects as Asp.NET Web API and DevExtreme. I have an error on call.js file about cors. My codes is following:

http://localhost:40623/signalr/negotiate?clientProtocol=1.5&connectionData=%5B%7B%22name%22%3A%22notificationshub%22%7D%5D&_=1431708909660. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://localhost:50847' is therefore not allowed access.

WebApiConfig file (Web API Project):

config.MapHttpAttributeRoutes();

config.EnableCors();

config.Routes.MapHttpRoute(
    name: "DefaultApi",
    routeTemplate: "api/{controller}/{id}",
    defaults: new { id = RouteParameter.Optional }
);

OWIN Startup File (Web API Project):

public void Configuration(IAppBuilder app)
{
    // For more information on how to configure your application, visit http://go.microsoft.com/fwlink/?LinkID=316888
    ConfigureAuth(app);

    GlobalHost.DependencyResolver.Register(typeof(IUserIdProvider), () => new UserIdProvider());

    //If I uncomment this line, then error will be:
    //The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:50847, *', but only one is allowed. Origin 'http://localhost:50847' is therefore not allowed access.
    //app.UseCors(CorsOptions.AllowAll);
    app.MapSignalR();
}

Web.Config file (Web API Project):

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <clear />
            <add name="Access-Control-Allow-Origin" value="*" />
            <add name="Access-Control-Allow-Headers" value="Authorization" />
        </customHeaders>
    </httpProtocol>
</system.webServer>

Calls.js file (DevExtreme Project):

$.connection.hub.url = "http://localhost:40623/signalr";
var notificationsHub = $.connection.notificationsHub;
notificationsHub.client.newCall = function (message) {
    viewModel.calls.load();
};
$.connection.hub.start();

What browser are you using? Also be careful with the wildcard *. You would be allowing all origins to pass through. — Jacob Finamore
– Jacob Finamore, Commented May 15, 2015 at 17:13
Also I must use *. Because I want to access to Web API from DevExtreme mobile application. — Yasin Uğur Yıldız
– Yasin Uğur Yıldız, Commented May 15, 2015 at 20:07

Jacob Finamore · Accepted Answer · 2015-05-15 17:27:50Z

1

You need to add this to your server config:

Access-Control-Allow-Origin: ORIGIN
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
Access-Control-Allow-Headers: Overwrite, Destination, Content-Type, Depth, User-Agent, Translate, Range, Content-Range, Timeout, X-File-Size, X-Requested-With, If-Modified-Since, X-File-Name, Cache-Control, Location, Lock-Token, If
Access-Control-Expose-Headers: DAV, content-length, Allow

If your using Apache the config file is called httpd.conf.

Access-Control-Allow-Origin: ORIGIN

can also be

Access-Control-Allow-Origin: *

or

Access-Control-Allow-Origin: ORIGIN | ORIGIN2 | ...

answered May 15, 2015 at 17:27

Jacob Finamore

7975 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Johan Aspeling Over a year ago

Where? How? This isnt in a format used in any config file as far as I am aware.

Community · Accepted Answer · 2017-05-23 12:33:23Z

0

The solution that worked for me was from this answer: {withCredentials: false}

$.connection.hub.start({ withCredentials: false }).done(function () {  //... }

edited May 23, 2017 at 12:33

CommunityBot

11 silver badge

answered Oct 31, 2016 at 4:27

Muhammad Omar ElShourbagy

7,1182 gold badges34 silver badges51 bronze badges

Collectives™ on Stack Overflow

Asp.NET Web API and SignalR Cors

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related