{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/136","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/136/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/136/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/136/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/136","id":161577284,"number":136,"title":"CORS of WEB API does not work if host IdentityServer together with WEB API in same project","user":{"login":"liupengf12","id":117811,"avatar_url":"https://avatars.githubusercontent.com/u/117811?v=3","gravatar_id":"","url":"https://api.github.com/users/liupengf12","html_url":"https://github.com/liupengf12","followers_url":"https://api.github.com/users/liupengf12/followers","following_url":"https://api.github.com/users/liupengf12/following{/other_user}","gists_url":"https://api.github.com/users/liupengf12/gists{/gist_id}","starred_url":"https://api.github.com/users/liupengf12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liupengf12/subscriptions","organizations_url":"https://api.github.com/users/liupengf12/orgs","repos_url":"https://api.github.com/users/liupengf12/repos","events_url":"https://api.github.com/users/liupengf12/events{/privacy}","received_events_url":"https://api.github.com/users/liupengf12/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-22T01:51:36Z","updated_at":"2016-06-22T03:21:08Z","closed_at":null,"body":"I setup the identity server and web api in same asp.net core project:\r\n````C#\r\n            services.AddMvcCore()\r\n                .AddJsonFormatters(options => options.ContractResolver = new CamelCasePropertyNamesContractResolver())\r\n                .AddAuthorization()\r\n                .AddCors(options =>\r\n                {\r\n                    options.AddPolicy(\"AllowOrigins\", policyBuilder =>\r\n                    {\r\n                        policyBuilder\r\n                        .WithOrigins(\"http://localhost:3000\")\r\n                        .AllowAnyMethod()\r\n                        .AllowAnyHeader();\r\n                    });\r\n                })\r\n                .AddApiExplorer()\r\n                .AddRazorViewEngine();\r\n\r\n            services.AddIdentityServer()\r\n                .SetSigningCredentials(cert)\r\n                .AddInMemoryClients(Clients.Get())\r\n                .AddInMemoryScopes(Scopes.Get());\r\n````\r\nBut all the requests of web api are failed with a 500 error:\r\n\r\n> System.ArgumentNullException: Value cannot be null.\r\nParameter name: policy\r\n   at Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePolicy(HttpContext context, CorsPolicy policy)\r\n   at Microsoft.AspNetCore.Mvc.Cors.CorsAuthorizationFilter.<OnAuthorizationAsync>d__9.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Mvc.Internal.FilterActionInvoker.<InvokeAuthorizationFilterAsync>d__35.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Mvc.Internal.FilterActionInvoker.<InvokeAsync>d__32.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Mvc.Internal.MvcRouteHandler.<InvokeActionAsync>d__8.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Builder.RouterMiddleware.<Invoke>d__4.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at IdentityServer4.Hosting.IdentityServerMiddleware.<Invoke>d__3.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at IdentityServer4.Hosting.BaseUrlMiddleware.<Invoke>d__2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.<Invoke>d__7.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Swashbuckle.SwaggerUi.Application.SwaggerUiMiddleware.<Invoke>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Swashbuckle.SwaggerUi.Application.RedirectMiddleware.<Invoke>d__4.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Swashbuckle.SwaggerGen.Application.SwaggerGenMiddleware.<Invoke>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.VisualStudio.Web.BrowserLink.Runtime.BrowserLinkMiddleware.<ExecuteWithFilter>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()\r\n   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()\r\n\r\nAlso there is another warning log:\r\n> CORS request made for path: /api/weixin/jssdkUiPackage from origin: http://localhost:3000 but rejected because invalid CORS path\r\n\r\nAfter checked the source codes of IdentityServer 4 I find the [relation codes](https://github.com/IdentityServer/IdentityServer4/blob/dev/src/IdentityServer4/Hosting/Cors/PolicyProvider.cs#L45) of this warning log.\r\nOnly the following paths are allowed:\r\n````C#\r\n            public static readonly string[] CorsPaths =\r\n            {\r\n                Oidc.DiscoveryConfiguration,\r\n                Oidc.DiscoveryWebKeys,\r\n                Oidc.Token,\r\n                Oidc.UserInfo,\r\n                Oidc.IdentityTokenValidation,\r\n                Oidc.Revocation\r\n            };\r\n````\r\n\r\nI'm not sure this should be a bug or the identity server is NOT allowed host together with web api project?"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/227632813","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/136#issuecomment-227632813","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/136","id":227632813,"user":{"login":"liupengf12","id":117811,"avatar_url":"https://avatars.githubusercontent.com/u/117811?v=3","gravatar_id":"","url":"https://api.github.com/users/liupengf12","html_url":"https://github.com/liupengf12","followers_url":"https://api.github.com/users/liupengf12/followers","following_url":"https://api.github.com/users/liupengf12/following{/other_user}","gists_url":"https://api.github.com/users/liupengf12/gists{/gist_id}","starred_url":"https://api.github.com/users/liupengf12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liupengf12/subscriptions","organizations_url":"https://api.github.com/users/liupengf12/orgs","repos_url":"https://api.github.com/users/liupengf12/repos","events_url":"https://api.github.com/users/liupengf12/events{/privacy}","received_events_url":"https://api.github.com/users/liupengf12/received_events","type":"User","site_admin":false},"created_at":"2016-06-22T03:21:08Z","updated_at":"2016-06-22T03:21:08Z","body":"@xyting Thanks for your reply, if choose your solution I have to add the url of each APIs, it is not a good solution. It seems I have to split the identity server into a new project.\r\n\r\nOr I can fork the identityserver4 and disable the CorsPaths validation :)"}}
{"actor":{"display_login":"liupengf12"}}