IE: "Origin not found in Access-Control-Allow-Origin header" using CORS enabled .NET Core and Angular 2 - angularjs

Question

I'm in the process of building an internal application where I am using Angular 2 (CLI/Webpack) to call a CORS enabled service that I built using .NET Core. The service uses the user's Integrated Windows Authentication credentials to look up information about that user and return it to Angular. Everything works fine in Chrome and Firefox, but in IE 10 and 11, I receive a "401 Unauthorized" response with the message Origin http://localhost:4200 not found in Access-Control-Allow-Origin header.
In Angular, I'm making an HTTP call like so:
private options = new RequestOptions({withCredentials: true});
let getURL = `server:port/api/users/username`;
return this.http
.get(getURL, this.options)
.map((response: Response) => response.json()[0])
.catch(this.handleError);
and my .NET Core service uses the following code in Startup.cs:
public void ConfigureServices(IServiceCollection services)
{
services.AddCors(options =>
{
options.AddPolicy("policyAnyone",
builder => {
builder.AllowCredentials()
.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader();
});
});
services.AddApplicationInsightsTelemetry(Configuration);
services.AddMvc();
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
loggerFactory.AddConsole(Configuration.GetSection("Logging"));
loggerFactory.AddDebug();
app.UseCors("policyAnyone");
app.UseApplicationInsightsRequestTelemetry();
app.UseApplicationInsightsExceptionTelemetry();
app.UseMvc();
}
The controller then uses the username it receives via User.FindFirst(ClaimTypes.Name).Value, runs a stored procedure, and returns the results.
For reference, Chrome has the following request headers:
Accept: application/json, text/plain, `*/*`
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Authorization: Negotiate %lotsOfEncodedText%
Cache-Control: max-age=0
Connection: keep-alive
content-type: text/plain
Host: server:port
Origin: http://localhost:4200
Referer: http://localhost:4200/dashboard
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36
and IE has these:
Request: GET /api/users/username HTTP/1.1
Accept: application/json, text/plain, `*/*`
Content-Type: text/plain
Referer: http://localhost:4200/dashboard
Accept-Language: en-US
Origin: http://localhost:4200
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: server:port
Connection: Keep-Alive
Cache-Control: no-cache
It seems as though CORS is configured correctly, and my Angular setup is pretty simple, but IE doesn't even display the credentials box.

Answer 1

In case anyone runs across this, I think I was able to solve the problem. My issue is with my PC's Internet Options where the Logon Authentication option (Internet Options > Security > Custom level... > User Authentication > Logon) was set to "Automatic logon only in Intranet zone". While this is intended, IE wasn't seeing my site as an intranet site, but rather an internet site. The reason for this is the "dot rule" that IE uses.
"If the URI’s hostname doesn’t contain any periods (e.g. http://team/) then it is mapped to the Local Intranet Zone." [1]
Our local site's hostname contains periods and is therefore mapped to the Internet Zone. After we are able to cut through the red tape, manually adding my site to the Local Intranet Zone (Internet Options > Security > Local Intranet > Sites > Advanced) should fix my issue.
I'm not sure why IE decided to respond with the CORS ACAO error message that it did, but the 401: Unauthorized response was at least enough to tip me off.
[1] Info on the Internet Option: https://support.microsoft.com/en-us/help/258063/internet-explorer-may-prompt-you-for-a-password
[2] Info on the Intranet Zone determination: https://blogs.msdn.microsoft.com/ieinternals/2012/06/05/the-intranet-zone/

Answer 2

IE treats ports differently than other browsers. Other browsers say that if the port is different, then it is not the same "origin". In IE, if the ports are different but the domain is the same, then it is same origin and the headers are not used.
You can read more here : https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#IE_Exceptions
However you should still see the returned data via Angular (Since IE would just treat them as same origin). So are you seeing response data at all from your ajax call?