ajax - Enable Access-Control-Allow-Credentials header in Azure website (Azure App Services)

Question

We recently migrated an API application from Azure Cloud Services to Azure Websites, and some clients are still using our legacy protocol for authentication, which uses cookies (instead of the usual Authorization: Bearer HTTP header). We need to support this authentication protocol for a little longer as the clients will not be able to migrate right away.

To support cookies in a cross-origin ajax request directed to the API, the client needs to set the withCredentials setting to true in the XMLHttpRequest, and the server needs to repond with the Access-Control-Allow-Credentials header as well to any CORS request.

The problem we face is that the Azure Website manages CORS all by itself, and uses its own configuration (which is limited to a list of allowed origins) for the response, which does not allow this header to be set... thus breaking the application for all our Ajax clients!

Is there a way to (temporarily) add this header in the responses?

Answer 1

We finally managed to understand the behavior of the Azure Apps CORS middleware. To disable it, you have to clear every single allowed origin entry in the CORS blade of your web app (including *). Then you can manage CORS by yourself, either using the Web Api 2 functionality or using the web.config.

The information is even available in the documentation:

Don't try to use both Web API CORS and App Service CORS in one API app. App Service CORS will take precedence and Web API CORS will have no effect. For example, if you enable one origin domain in App Service, and enable all origin domains in your Web API code, your Azure API app will only accept calls from the domain you specified in Azure.

So the final answer is: If your application does not need a very specific CORS management, you can use Azure App Service CORS. Otherwise you will need to handle it yourself and disable all CORS configuration in the web app.