ASP.NET Core 2.2 Always returns 404 due to "The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time." error

[whizkidwwe1217]

Describe the bug

Before I upgraded to ASP.NET Core 2.2, everything works fine. But after the upgrade, all requests are returning 404 and always producing CORS related warnings. I didn't change anything except for the asp.net versions.

warn: Microsoft.AspNetCore.Cors.Infrastructure.CorsService[11]
The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the policy by listing individual origins if credentials needs to be supported.

To Reproduce

public void ConfigureServices(IServiceCollection services)
{
      services.AddCors();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
     app.UseCors(builder => builder
         .AllowAnyOrigin()
         .AllowAnyHeader()
         .AllowAnyMethod()
         .AllowCredentials()
     );
}

Program.cs

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
     WebHost.CreateDefaultBuilder(args)
         .UseUrls(new string[] { "https://*:5000", "https://*:5001", "https://*:5002", "https://*:5003"})
         .UseStartup<Startup>();

Http Request/Response:

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

.NET Core SDK (reflecting any global.json):
 Version:   2.2.100
 Commit:    b9f2fa0ca8

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.17134
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.2.100\

Host (useful for support):
  Version: 2.2.0
  Commit:  1249f08fed

.NET Core SDKs installed:
  2.0.0 [C:\Program Files\dotnet\sdk]
  2.0.2 [C:\Program Files\dotnet\sdk]
  2.0.3 [C:\Program Files\dotnet\sdk]
  2.1.2 [C:\Program Files\dotnet\sdk]
  2.1.4 [C:\Program Files\dotnet\sdk]
  2.1.200 [C:\Program Files\dotnet\sdk]
  2.1.202 [C:\Program Files\dotnet\sdk]
  2.1.300-preview2-008533 [C:\Program Files\dotnet\sdk]
  2.1.302 [C:\Program Files\dotnet\sdk]
  2.1.402 [C:\Program Files\dotnet\sdk]
  2.1.403 [C:\Program Files\dotnet\sdk]
  2.1.500 [C:\Program Files\dotnet\sdk]
  2.2.100 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.0-preview2-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.0-preview2-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.0-preview2-26406-04 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

[pranavkm]

The CORS warning message was an intentional change in 2.2 to address #3106. I'm not entirely sure about the 404 though, the server response code shouldn't have changed. Any chance you could get a small repro app for this? Maybe your controller action \ endpoint isn't being discovered.

[enetstudio]

@whizkidwwe1217,
First off, remove the call to AllowCredentials()...
Well, we don't expect the server to return a message telling the user that the request url was found, but you shouldn't use AllowAnyOrigin and AllowCredentials together, do we ?
Read more here https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.2

[whizkidwwe1217]

Okay so I just temporarily removed CORS in my app to get rid of the warning. But why am I getting 404 with all http requests? There's nothing mentioned in the asp.net core 2.2 docs of breaking changes but when I upgraded from 2.1, it broke the entire application. @pranavkm My app uses StructureMap as the DI container and it works flawlessly in 2.1. If the controllers are not being discovered, does it mean that the StructureMap does not work in 2.2?

[pranavkm]

But why am I getting 404 with all http requests?

That's a mystery to me as well. A repro app would certainly help. The most significant change in 2.2 that might affect you was the introduction of Endpoint Routing - you could try eliminating it as a possible source of the issue by trying to turn it off: services.AddMvc(options => options.EnableEndpointRouting = false) assuming you're running with 2.2 CompatibilityVersion

[whizkidwwe1217]

@pranavkm Turning off EnableEndpointRouting didn't work. I've been debugging this project for 2 days now and I still can't get it working. It's blocking me from upgrading to 2.2 because it just broke the entire application. Could you please take a look at this repo (master branch is for the 2.2 & dotnet2.1 for the 2.1 version): https://github.com/whizkidwwe1217/GoldRush.git? I'm not sure if ASP.NET Core 2.2 changes the way it loads the dependencies. My app is composed of multiple projects and mostly powered by StructureMap DI container. Please take a look at the repo. Here's how you run it:

The main startup project is the SimpleApp, so you have to dotnet run there.
The Startup class inherits the NewStartup class in Infrastructure project (I made a stripped down version) that wires up all the dependencies and services. There are also core controllers in the Infrastructure project, which contains common endpoints/actions. By the way, all projects except SimpleApp are just my framework libraries. I used these libraries whenever I create any type of multi-tenant applications. I noticed that only those controllers that are in the startup project (SimpleApp) are discoverable and the ones that are in the library projects are not being discovered (I'm not very sure).

You can try these end points to test it:

Controller actions from the startup project (SimpleApp)
https://localhost:5001/api/values
https://localhost:5001/api/sample/info -- This sample controller action will display the dependencies loaded in StructureMap DI

Controller actions from the core projects (i.e. Infrastructure, etc.)
https://localhost:5001/api/app/info
https://localhost:5001/api/app/assembly
These endpoints always return 404 response.

It works fine in asp.net core 2.1 but when I bumped the version to 2.2, it just broke the entire application.

[whizkidwwe1217]

I think I can safely say that controllers from a separate DLL or project don't work in ASP.NET Core 2.2. I created a simple controller in Infrastructure project and it isn't being hit by http request.

In ASP.NET Core 2.1, it works fine. In 2.2, I need to AddApplicationPart the assemblies. I'm closing this issue.

[z5616342]

remove the call to AllowCredentials()

I resolved the warning