ASP.NET 5 beta8 CORS with Authorize attribute not working

Question

The beta version of CORS succeeded in installing the following:

// in the ConfigurationServices
services.AddMvc();
services.ConfigureCors(options =>
{
    // set cors settings...
});

//...
// in the Startup.Configure method
app.UseCors();
app.UseMvc();

It worked like a charm, but a beta break is ripping it apart. I found these questions: Why does Cors not work after upgrading to beta8 on ASP.NET 5? and fixed as follows:

// in Startup.ConfigureServices method
services.AddCors(options =>
{
    options.AddPolicy("CorsPolicy", builder =>
    {
        // allow them all
        builder.AllowAnyHeader();
        builder.AllowAnyMethod();
        builder.AllowAnyOrigin();
        builder.AllowCredentials();
    });
});
services.AddMvc();

//...
// in the Startup.Configure method
app.UseMvc();

//...
// in the Controller
[EnableCors("CorsPolicy")]
public IActionResult Get()
{
    return OK();
}

Yes, it works again, but when I add [Authorize("Bearer")], the controller returns 401 Unauthorized for the OPTIONS request via an ajax call. Here is the HTTP request and response.

[Request]

OPTIONS https://api.mywebsite.net/ HTTP/1.1
Accept: */*
Origin: https://myanotherwebsite.net
Access-Control-Request-Method: GET
Access-Control-Request-Headers: accept, authorization
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko
Host: api.mywebsite.net
Connection: Keep-Alive
Cache-Control: no-cache

[Answer]

HTTP/1.1 401 Unauthorized
Content-Length: 0
Server: Microsoft-IIS/8.0
WWW-Authenticate: Bearer
X-Powered-By: ASP.NET
Set-Cookie: ARRAffinity=...;Path=/;Domain=api.mywebsite.net
Date: Fri, 23 Oct 2015 09:56:34 GMT

How to enable CORS with attribute [Authorization]in ASP.NET 5 beta8?

Edit ASP.NET MV C ( 8). [EnableCors], [Authorize], 401 Unauthorized ( 302 ).

Edit2 , . , .

Answer 1

, . Microsoft.AspNet.Mvc.Cors Microsoft.AspNet.Cors.

OWIN, - Mvc. Microsoft.AspNet.Cors Project.json, app.UseCors() Configures().

AddCors() ConfigureServices() UseCors() Configure() .

CORS.

( Project.json)

"dependencies": {
  ...
  "Microsoft.AspNet.Cors": "6.0.0-beta8",
  "Microsoft.AspNet.Mvc.Cors": "6.0.0-beta8",
  ...
}

( Startup.cs)

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddPolicy("CorsPolicy", builder =>
        {
            // ...build cors options...
        });
    });
    services.AddMvc();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseIISPlatformHandler();
    app.UseStaticFiles();
    app.UseCors("CorsPolicy");
    app.UseMvc();
}

, :

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors();
    services.AddMvc();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseIISPlatformHandler();
    app.UseStaticFiles();
    app.UseCors(builder =>
    {
        // ...default cors options...
    });
    app.UseMvc();
}

, , .