title: ASP.NET Core 3.1 + CORS + Windows Authentication = 401 Unauthorized
body: <p>I have configured the <a href="https://blogs.iis.net/iisteam/getting-started-with-the-iis-cors-module" rel="nofollow noreferrer">IIS CORS Module</a> in my .NET Core 3.1(.201) web API hosted on IIS 10 and now I get <code>401 Unauthorized</code> on GET (not OPTIONS) requests for Windows authenticated users, <strong>with or withoud</strong> the <code>[Authorize]</code> attribute at controller or action level. Swagger instead goes through, returning 200 on the same action, so I'm thinking the authorization works, therefore the issue must be related to CORS somehow. </p>
  
  <p>I've seen some workarounds enabling anonymous authentication and setting some authorization filters in <code>Startup.cs</code> but I'd like to stick with the IIS CORS Module since it was designed to properly cover this scenario, among others.</p>
  
  <p>So maybe someone can help me figure out what am I doing wrong.</p>
  
  <p>web.config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
    &lt;system.web&gt;
      &lt;authentication mode="Windows" /&gt;
      &lt;authorization&gt;
        &lt;allow users="*" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;location path="." inheritInChildApplications="false"&gt;
      &lt;system.webServer&gt;
        &lt;cors enabled="true" failUnlistedOrigins="false"&gt;
          &lt;add origin="http://localhost:4300" allowCredentials="true"&gt;
            &lt;allowHeaders allowAllRequestedHeaders="true"&gt;
              &lt;add header="credentials" /&gt;
            &lt;/allowHeaders&gt;
          &lt;/add&gt;
        &lt;/cors&gt;
        &lt;handlers&gt;
          &lt;add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" /&gt;
        &lt;/handlers&gt;
        &lt;aspNetCore processPath="...\bin\Debug\netcoreapp3.1\MyProj.Api.exe" hostingModel="InProcess" forwardWindowsAuthToken="true"&gt;
          &lt;environmentVariables&gt;
            &lt;environmentVariable name="COMPLUS_ForceENC" value="1" /&gt;
            &lt;environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" /&gt;
          &lt;/environmentVariables&gt;
        &lt;/aspNetCore&gt;
      &lt;/system.webServer&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Startup.cs</p>
  
  <pre><code>services.AddAuthentication(IISDefaults.AuthenticationScheme);
  
  ...
  
  app.UseRouting();
  
  app.UseAuthentication();
  app.UseAuthorization();
  
  app.UseStaticFiles();
  
  app.UseEndpoints(endpoints =&gt; ...
  </code></pre>
  
  <p>The javascript request (which uses <code>fetch API</code>) sets the <code>credentials: include</code> header. </p>
  
  <p>I also tried <a href="https://weblog.west-wind.com/posts/2019/Nov/14/FireFox-Windows-Security-and-Kestrel-on-ASPNET-Core" rel="nofollow noreferrer">the approach suggested by Rick Strahl</a> on his great web log but I got the same result: 401 </p>