The startup file for .NET Core 2.2 has been configured as shown below:
var key = Encoding.ASCII.GetBytes(AppSettings.Secret);
services.AddAuthentication(x =>
{
x.DefaultAuthenticateScheme = IISDefaults.AuthenticationScheme;
x.DefaultChallengeScheme =
JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, x =>
{
x.RequireHttpsMetadata = false;
x.SaveToken = true;
x.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
};
});
Within the configure method:
app.UseCors("CorsPolicy");
app.UseAuthentication();
app.UseMvc();
I am utilizing .NET Core APIs in my Angular 7 SPA application and making calls to my API method:
this.http.get<User>(path + 'api/' + 'users', { withCredentials: true })
However, upon initial access of the Angular application, the API call fails with a 401 error in the logs. The network tab shows the status as (failed), but upon reloading the application, it works. This error seems to occur randomly, and can be reproduced when attempting to access the application in incognito mode.
This issue only arises on deployed applications on Windows web servers where Anonymous and Windows authentication are both enabled.
No changes have been made to program.cs, which remains at the default configuration for .NET Core 2.2.
Despite extensive research and trying various suggestions found online, none have provided a solution. Is there another area I should investigate?