.net 4.8 - CORS Error Despite Adding Custom AddCrossDomainHeader Rule in IIS - Stack Overflow

admin管理员组

文章数量:1405316

I'm trying to add CORS headers for specific domains using the following rule:

<rewrite>
            <outboundRules>
    <rule name="AddCrossDomainHeader">
    <match serverVariable="RESPONSE_Access_Control_Allow_Origin" pattern=".*" />
    <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
        <add input="{CAPTURED_ORIGIN}" pattern="^(https:\/\/(sitename-(dev|qa|uat)\.domain2\|utech-sandbox\.domain\|subdomain\.domain\|uat\.program\))$|^(https:\/\/localhost:7024)$" />
    </conditions>
    <action type="Rewrite" value="{C:0}" />
</rule>
</rewrite>
            </outboundRules>

However, I am still encountering CORS errors when making requests from the frontend. The error message I get is something like:

Access to XMLHttpRequest at '...' from origin '...' has been blocked by CORS policy

What I've Observed:

Locally: This works as expected when I run a demo application locally. The CORS header is added correctly.

Deployed: When I deploy the same configuration to my server, the CORS header (Access-Control-Allow-Origin) is not being set in the response, leading to the CORS error.

What I Have Tried: Access-Control-Allow-Methods and Access-Control-Allow-Headers headers are configured correctly. I can see the Access-Control-Allow-Origin header isn't appearing in the response from the deployed server. The CAPTURED_ORIGIN value seems to be correctly identified during testing, but the rewrite rule doesn't seem to apply on the deployed server.

Questions: Is there something specific in the IIS configuration that I might have missed in the deployed environment? Are there any other CORS-related headers I should consider that might impact the origin header? Could there be issues related to the server's network setup or permissions that might prevent the rewrite rule from working correctly on deployment?

Any help or pointers would be greatly appreciated!

本文标签： net 48CORS Error Despite Adding Custom AddCrossDomainHeader Rule in IISStack Overflow