title: 403 (Forbidden) response from SignalR Hub using ASP.NET hosting on IIS server
body: <p>I'm hosting a SignalR Hub on Windows Server 2012 with IIS as an ASP.NET Web application that I've tested successfully on my local machine. But when I publish  and try to connect from a Angular application the server responds with 403 Forbidden on the /negotiate request. The Angular application is located on a different domain then the Hub server.</p>
  
  <p>I've read that this is caused by a CORS issue, but I've tried every solution I can find without any change. Can it be a IIS server issue or have I missed something in my code?</p>
  
  <p>The route being called is <a href="https://example.com/signalr/negotiate" rel="nofollow noreferrer">https://example.com/signalr/negotiate</a></p>
  
  <p><strong>SignalR Server:</strong></p>
  
  <pre><code>public class Startup
  {
      public void Configuration(IAppBuilder app)
      {
          app.Map("/signalr", map =&gt;
          {
              map.UseCors(CorsOptions.AllowAll);
  
              var hubConfiguration = new HubConfiguration
              {
                  EnableJSONP = true,
                  EnableDetailedErrors = true
              };
  
              map.RunSignalR(hubConfiguration);
          });
      }
  }
  
  // Hub that handles Online user list
  public class OnlineHub : Hub
  {
      private static List&lt;AppUserDto&gt; _usersOnline = new List&lt;AppUserDto&gt;();
  
      public OnlineHub()
      {
          // Automapper Setup
          MappingConfig.Init();
      }
  
      public override Task OnConnected()
      {
          var user = GetUser();
          _usersOnline.Add(user);
          Clients.All.listUpdated(_usersOnline);
  
          return base.OnConnected();
      }
  
      public override Task OnReconnected()
      {
          var user = GetUser();
  
          // Add user to list of online users if it doesn't exist
          if (!_usersOnline.Any(u =&gt; u.Email == user.Email))
          {
              _usersOnline.Add(user);
              Clients.All.listUpdated(_usersOnline);
          }
  
          return base.OnReconnected();
      }
  
      public override Task OnDisconnected(bool stopCalled)
      {
          var user = GetUser();
          if (!_usersOnline.Any(u =&gt; u.Email == user.Email))
          {
              // Remove user from list of online users
              _usersOnline.Remove(user);
  
              Clients.All.listUpdated(_usersOnline);
          }
  
          return base.OnDisconnected(stopCalled);
      }
  
      private AppUserDto GetUser()
      {
          using (var db = new EntityDbContext())
          {
              // Get connected AppUserDto
              var user = db.AppUsers.FirstOrDefault(u =&gt; u.UserName == Context.User.Identity.Name);
              // Add user to list of online users
              if (user != null)
              {
                  return Mapper.Map&lt;AppUserDto&gt;(user);
              }
  
              return null;
          }
      }
  }
  </code></pre>
  
  <p><strong>Angular Application SignalR Service</strong></p>
  
  <pre><code>import { AppSettings } from './../app.settings';
  import { EventEmitter, Injectable } from '@angular/core';
  
  declare const $: any;
  
  @Injectable()
  export class SignalRService {
    // Declare the variables
    private proxy: any;
    private connection: any;
    private authData: any;
    // create the Event Emitter
    public messageReceived: EventEmitter&lt;any&gt;;
    public connectionEstablished: EventEmitter&lt;Boolean&gt;;
    public connectionExists: Boolean;
  
    constructor(private appSettings: AppSettings) {
      // Setup
      this.connectionEstablished = new EventEmitter&lt;Boolean&gt;();
      this.messageReceived = new EventEmitter&lt;any&gt;();
      this.connectionExists = false;
    }
  
    public initialize(proxyName: string): void {
      this.connection = $.hubConnection(this.appSettings.SIGNALR_BASE_URL);
      this.proxy = this.connection.createHubProxy(proxyName);
      this.registerOnServerEvents();
      this.startConnection();
    }
  
    private startConnection(): void {
      this.connection.start({withCredentials: false})
        .done((data: any) =&gt; {
          console.log('SignalR Connected with: ' + data.transport.name);
          this.connectionEstablished.emit(true);
          this.connectionExists = true;
        })
        .fail((error: any) =&gt; {
          console.log('SignalR could not connect: ' + error);
          this.connectionEstablished.emit(false);
        });
    }
  
    private registerOnServerEvents() {
      this.proxy.on('listUpdated', (list: any) =&gt; {
        console.log(list);
        this.messageReceived.emit(list);
      });
    }
  }
  </code></pre>
  
  <p>initialize(proxyName) gets called from a controller to start a connection to the Hub.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I've tried to rebuild the server and Hub using .NET Core 2.0, but when I test that on the IIS server I get: </p>
  
  <p><strong>"Failed to load <a href="https://signalr.example.com/online/negotiate" rel="nofollow noreferrer">https://signalr.example.com/online/negotiate</a>: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://example.com" rel="nofollow noreferrer">https://example.com</a>' is therefore not allowed access."</strong></p>
  
  <p>So it's still a CORS issue even though I've setup everything just as multiple guides have done.</p>