CORS headers not being set when using dot (".") in query string

Question

I'm having a strange and weird situtation here.

If I send a request to: /scenes/?lang=es-ar, the headers are set just fine and everything seems OK.

However, if I send one to: /scenes/?lang=es-ar&sort.asc=creation, the headers are missing and I'm unable to fetch the response due to cross origin.

CORS is automatically managed by Owin's CORS Middleware, so this is out of my hands.

Here is my middleware's configuration:

private void ConfigureCors(IAppBuilder application)
{
    CorsPolicy policy = new CorsPolicy()
    {
        AllowAnyHeader = true,
        AllowAnyOrigin = true,
        SupportsCredentials = true,
    };

    policy.Methods.Add("GET");
    policy.Methods.Add("POST");
    policy.Methods.Add("PUT");
    policy.Methods.Add("DELETE");
    policy.Methods.Add("OPTIONS");

    policy.ExposedHeaders.Add("Location");

    application.UseCors(new CorsOptions()
    {
        PolicyProvider = new CorsPolicyProvider()
        {
            PolicyResolver = request => System.Threading.Tasks.Task.FromResult(policy)
        }
    });
}

Why are the headers not being sent on the response?

I'm guessing it has something to with the "." (dot) in sort.asc=creation

I'm using latest version of ASP.NET Web Api (5.2.3) and Microsoft.Owin.Cors (3.0.1)

Answer 1

There might be a possibility that hosting server IIS might be intercepting the pre-flight requests. To ensure ASP.NET handles OPTION requests, add the following in web.config:

        <system.webServer>
          <handlers>
            <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
            <remove name="OPTIONSVerbHandler" />
            <remove name="TRACEVerbHandler" />
            <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" 
              type="System.Web.Handlers.TransferRequestHandler" 
              preCondition="integratedMode,runtimeVersionv4.0" />
          </handlers>
        </system.webServer>

In my opinion this is not a decent choice to use Microsoft.Owin.Cors with WebAPI, if you're planning to use IIS as hosting environment. A better choice for Asp.net WebAPi would be Asp.net web API implementation of CORS.