Enable Access-Control-Allow-Credentials header in Azure website (Azure App Services)

Question

We recently migrated an API application from Azure Cloud Services to Azure Websites, and some clients are still using our legacy protocol for authentication, which uses cookies (instead of the usual Authorization: Bearer HTTP header). We need to support this authentication protocol for a little longer as the clients will not be able to migrate right away.

To support cookies in a cross-origin ajax request directed to the API, the client needs to set the withCredentials setting to true in the XMLHttpRequest, and the server needs to repond with the Access-Control-Allow-Credentials header as well to any CORS request.

The problem we face is that the Azure Website manages CORS all by itself, and uses its own configuration (which is limited to a list of allowed origins) for the response, which does not allow this header to be set... thus breaking the application for all our Ajax clients!

Is there a way to (temporarily) add this header in the responses?

Answer 1

We finally managed to understand the behavior of the Azure Apps CORS middleware. To disable it, you have to clear every single allowed origin entry in the CORS blade of your web app (including *). Then you can manage CORS by yourself, either using the Web Api 2 functionality or using the web.config.

The information is even available in the documentation:

Don't try to use both Web API CORS and App Service CORS in one API app. App Service CORS will take precedence and Web API CORS will have no effect. For example, if you enable one origin domain in App Service, and enable all origin domains in your Web API code, your Azure API app will only accept calls from the domain you specified in Azure.

So the final answer is: If your application does not need a very specific CORS management, you can use Azure App Service CORS. Otherwise you will need to handle it yourself and disable all CORS configuration in the web app.

Answer 2

This is Something that you can do in the web.config file that is available in your web app.

You can edit it using Visual Studio Online (Monaco) which is a Tools that you add from the Azure Portal.

Read more here : http://enable-cors.org/server_iis7.html

Answer 3

This is now supported in the Azure App Service CORS feature. Unfortunately there is not a UX for it yet, so it is a little painful to enable. There are currently two straightforward methods.

1. On the Azure Portal, navigate to your Web App. Navigate to API > CORS. There is now a checkbox for Enable Access-Control-Allow-Credentials. Check this box and press Save.

2. Use the Azure CLI with the following command:

az resource update --name web --resource-group myResourceGroup --namespace Microsoft.Web --resource-type config --parent sites/<app_name> --set properties.cors.supportCredentials=true --api-version 2015-06-01

You can see more documentation here.

NOTE: This does not work with * as an allowed origin. This is a security choice we decided to make.