Blazor WASM - Access to fetch at "https://login.microsoftonline.com/...." (redirected from ...) from origin ... has been blocked by "CORS" policy: - azure-active-directory

Question

I am building a WASM hosted app with multiple clients and started to get the following error when I called a WebApi controller from the Client project.
Access to fetch at 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=0e5f2876-c.......-client-SKU=ID_NET6_0&x-client-ver=6.23.1.0'
(redirected from 'https://localhost:5001/WeatherForecast') from origin 'https://localhost:5001'
has been blocked by CORS policy:
Response to preflight request doesn't pass access control check:
No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
I ended up working out what the problem was and thought I would document it here as I wasn't able to find a writeup of a similar situation.
My WebApi project was configured as follows. (ie. with AddMicrosoftIdentityWebApi and AddMicrosoftIdentityWebApp in the same project.)
Program.cs (Server Project)
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
The project worked fine with just AddMicrosoftIdentityWebApi, but started generating the error when I added AddMicrosoftIdentityWebApp.

Answer 1

It turns out that the reason for the error is that the controller that I'm targeting did not know which Authentication Scheme to target. The CORS message was a red-herring (even though it is technically correct in hindsight).
I had to be explicit in my [Authorize] atrribute as per the following.
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[ApiController]
[Route("[controller]")]
public class WeatherForecastController : ControllerBase
{
private static readonly string[] Summaries = new[]
{
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};
private readonly ILogger<WeatherForecastController> _logger;
public WeatherForecastController(ILogger<WeatherForecastController> logger)
{
_logger = logger;
}
[HttpGet]
public IEnumerable<WeatherForecast> Get()
{
return Enumerable.Range(1, 5).Select(index => new WeatherForecast
{
Date = DateTime.Now.AddDays(index),
TemperatureC = Random.Shared.Next(-20, 55),
Summary = Summaries[Random.Shared.Next(Summaries.Length)]
})
.ToArray();
}
}