c# - Aurelia Windows Authentication - Post 401 Unauthorized -

i'm totally stuck on implementing windows authentication 1 of .net core apps uses aurelia client side.

the aurelia application hosted on port:9000 , .net webapi hosted on port:9001.

the idea serve static pages .net app once app published in development use port:9000 because of browsersync provided aurelia.

when use port:9000 it's fine , dandy , have no issues posting or getting.

if switch port:9001 can still not post. posting results in 401 unauthorized.

if @ headers port:9000 requests..

get(success):

post(failed):

you can see there multiple headers missing in post reasons, importantly authentication cookie..

base-repo.js

import {inject} 'aurelia-framework'; import {httpclient, json} 'aurelia-fetch-client'; import {appsettings} '../infrastructure/app-settings';  @inject(httpclient, appsettings)  export class baserepo {     constructor(http, appsettings) {         http.configure(config => {             config                 .withdefaults({                     credentials: 'include',                     headers: {                         'accept': 'application/json'                     }                 })                 .withinterceptor({                     request(request) {                         console.log(`requesting ${request.method} ${request.url}`);                         return request;                     },                     response(response) {                         console.log(`received ${response.status} ${response.url}`);                         return response;                     }                 })         });          this.http = http;         this.baseurl = appsettings.api;     }      get(url) {         console.log('baserepo(get): ' + url);         return this.http.fetch(this.baseurl + url)             .then(response => { return response.json(); })             .then(data => { return data; });     }      post(url, data) {         console.log('baserepo(post): ' + url, data);         return this.http.fetch(this.baseurl + url, {             method: 'post',             body: json(data)         })             .then(response => response.json())             .then(data => { return data; });     } } 

why working not post when using browsersync port?

edit 1

post(success) port:9001:

edit 2 console message post error:

options http://localhost:9001/api/myurls 401 (unauthorized)

fetch api cannot load http://localhost:9001/api/myurls. response preflight request doesn't pass access control check: no 'access-control-allow-origin' header present on requested resource. origin 'http://localhost:9000' therefore not allowed access. response had http status code 401. if opaque response serves needs, set request's mode 'no-cors' fetch resource cors disabled.

edit 3

startup.cs

public class startup     {         public startup(ihostingenvironment env)         {             var builder = new configurationbuilder()                 .setbasepath(env.contentrootpath)                 .addjsonfile("appsettings.json", optional: false, reloadonchange: true)                 .addjsonfile($"appsettings.{env.environmentname}.json", optional: true)                 .addenvironmentvariables();             configuration = builder.build();              env.configurenlog("nlog.config");         }          public iconfigurationroot configuration { get; }          public void configureservices(iservicecollection services)         {             services.addcors(options =>             {                 options.addpolicy("corspolicy",                     builder => builder.allowanyorigin()                         .allowanymethod()                         .allowanyheader()                         .allowcredentials());             });              services.addmemorycache();             services.addmvc();              services.injectwebservices();              services.addoptions();              //call in case need aspnet-user-authtype/aspnet-user-identity             services.addsingleton<ihttpcontextaccessor, httpcontextaccessor>();              services.addsingleton<iconfiguration>(configuration);         }          public void configure(iapplicationbuilder app, ihostingenvironment env, iloggerfactory loggerfactory)         {             app.usecors("corspolicy");              loggerfactory.addconsole(configuration.getsection("logging"));              loggerfactory.adddebug();              app.usemvc();              app.usedefaultfiles();              app.usestaticfiles();              //add nlog asp.net core             loggerfactory.addnlog();              //add nlog.web             app.addnlogweb();         }     } 

you need enable cors in asp.net core project. there's information on how here: https://docs.microsoft.com/en-us/aspnet/core/security/cors.

when you're using port 9000, you're on different origin api, 9001, you're on same origin , therefore cors not apply.

the options requests known "preflighting". there's more information on here: https://developer.mozilla.org/en-us/docs/web/http/access_control_cors#preflighted_requests.