Access denied to ASP.NET WebAPI on IIS

Question

I have to ASP.NET applications: one is a Web API and the other a MVC that makes requests to the first.

Everthing works in development (VS with IIS Express) but now I publish both applications to a production server and I can´t have access to the api using the MVC app.

I have CORS enabled on the API:

var cors = new EnableCorsAttribute("*", "*", "*");
config.EnableCors(cors);

On the MVC app, my api base url is set to https://localhost:44351/ and then in the IIS I have this bindings (WEB Api site):

I can make requests to the API with postman but when I run the my MVC app, I can´t make requests (and again, I could make them in development).

Thank you.

EDIT

Controller code example (MVC):

        try
        {
            var client = WebApiHttpClient.GetClient();

            var response = await client.PostAsync("Token", content);
            if (response.IsSuccessStatusCode)
            {
                TokenResponse tokenResponse =
                await response.Content.ReadAsAsync<TokenResponse>();

                WebApiHttpClient.storeToken(tokenResponse);
                return RedirectToAction("Index", "Home");
            }
            else
            {
                return Content("response.StatusCode);
            }
        }
        catch
        {
            return Content("Error");
        }

My HttpClient implementation:

    public const string WebApiBaseAddress = "https://localhost:44351/";

    public static HttpClient GetClient()
    {
        HttpClient client = new HttpClient();
        client.BaseAddress = new Uri(WebApiBaseAddress);
        client.DefaultRequestHeaders.Accept.Clear();
        client.DefaultRequestHeaders.Accept.Add(new
        MediaTypeWithQualityHeaderValue("application/json"));
        return client;
    }

EDIT 2

InnerException message:

the underlying connection was closed could not establish trust relationship for the ssl/tls

What do you mean by "can't make requests"? What kind of response do you get? — Viktors Telle
– Viktors Telle, Commented Dec 13, 2016 at 19:14
And also you don't need to enable CORS because you are making request from the same domain. — Viktors Telle
– Viktors Telle, Commented Dec 13, 2016 at 19:28
There is an issue with SSL certificate. Please see this post: stackoverflow.com/questions/703272/… — Viktors Telle
– Viktors Telle, Commented Dec 13, 2016 at 20:02

Community · Accepted Answer · 2017-05-23 11:45:41Z

2

Just to summarize the discussion in the comments. The problem was due to use of self-signed certificate in IIS for Web API application.

Temporary solution for this problem is to add this line of code in application startup class (Global.asax):

ServicePointManager.ServerCertificateValidationCallback = ((sender, certificate, chain, sslPolicyErrors) => true);

Of course you should not use that line of code in production. In production environment you should have a valid SSL certificate.

More information can be found in this post: Could not establish trust relationship for SSL/TLS secure channel -- SOAP

edited May 23, 2017 at 11:45

CommunityBot

11 silver badge

answered Dec 14, 2016 at 13:33

Viktors Telle

7839 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Access denied to ASP.NET WebAPI on IIS

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related