SignalR Core 2.2 CORS AllowAnyOrigin() breaking change

Question

To connect via SignalR to an ASP.NET Core 2.1 server from any origin, we had to configure the pipeline as follows:

app.UseCors (
  builder => builder
   .AllowAnyHeader ()
   .AllowAnyMethod ()
   .AllowAnyOrigin ()
   .AllowCredentials ()
)

According to this document, ASP.NET Core 2.2 no longer allows the combination of AllowAnyOrigin and AllowCredentials, so what would be the solution? Whereas the SignalR Core always sends withCredentials:true in the XMLHtppRequest.

What I need is that from any origin and without credentials, our users can connect to the SignalR Hub.

Sawicki

The link you site seems to have steps to get around this. Are those steps not working for you? – Aberration

From the doc: "Modify the CORS policy to no longer allow credentials. That is, remove the call to AllowCredentials when configuring the policy". Signalr doesn't have the option to disable withcredentials property, so, no the link does not help. Why the down vote? – Sawicki

Answer 1

There is a workaround, change AllowAnyOrigin to SetIsOriginAllowed:

app.UseCors(builder => builder
                .AllowAnyHeader()
                .AllowAnyMethod()
                .SetIsOriginAllowed(_ => true)
                .AllowCredentials()
            );

Sawicki

man thank you, this was an intelligent question with an intelligent answer. – Mope

Allowing arbitrary origins with credentials is very insecure, hence my downvote. The number of upvotes boggles the mind... – Oriel

Great for development purposes. – Diaper

Answer 2

I have found a solution. You can try the following code part:

.SetIsOriginAllowed (_ => true)

This worked for me.

Malvinamalvino

Answer 3

You can use the "WithOrigins" method passing the origins, maybe read by configuration.

app.UseCors(builder => builder
            .AllowAnyHeader()
            .AllowAnyMethod()
            .WithOrigins(new string[] { "www.example1.com", "www.example2.com" })
            .AllowCredentials()
        );

If the only string passed is " * " you still have problems with signalR. If you pass many strings and one of them is " * ", it works.

Hack

A working solution was already posted by Alexandre. The author asked 'What I need is that from any origin and without credentials', so your answer is not correct. I think your intension is to tell the people that there is another way with declaring specific origins, but you should post something like that as comment. – Arron

@Arron the question from op is not exactly clear...since he says that SignalR sends always credentials and then that he doesn't want credentials.....so this sounds like another way to solve the problem – Homicidal