title: No bearer token or refresh token being returned in response, CORS suspected - ServiceStack
body: <p>In my development environment, everything works fine. Going to staging, however, now we have different domains and CORS issues for sure, which I have fully resolved expect for potentially one issue.</p>
  
  <p>Regarding my CORS configuration for my APIs I am using the <code>Microsoft.AspNetCore.Cors</code> Nuget package because I could not find a way to whitelist certain domains using ServiceStack CORS feature, and I read ServiceStack documentation... I now know that when I instantiate the ServiceStack feature there is an overload constructor:</p>
  
  <pre><code>CorsFeature(ICollection&lt;string&gt; allowOriginWhitelist, string allowedMethods = "GET, POST, PUT, DELETE, PATCH, OPTIONS", string allowedHeaders = "Content-Type", bool allowCredentials = false, string exposeHeaders = null, int? maxAge = null); 
  </code></pre>
  
  <p>Anyways, so I am using <code>Microsoft.AspNetCore.Cors</code>. With CORS correctly configured for my needs in my staging environment I am getting successful auth responses from my ServiceStack auth API like this:</p>
  
  <pre><code>{
    "UserId": "1",
    "SessionId": "V8wCKxOooCwLsQ1cn2jp",
    "DisplayName": "foo",
    "ReferrerUrl": "mydomain",
    "ResponseStatus": {}
  }
  </code></pre>
  
  <p>And here is an actual response screenshot:
  <a href="https://i.stack.imgur.com/3KVIm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3KVIm.png" alt="enter image description here"></a></p>
  
  <p>Just like this ServiceStack <a href="https://forums.servicestack.net/t/not-getting-bearertoken-in-ajax-response/4031" rel="nofollow noreferrer">user was experiencing</a>. In this referenced link I see @mythz say this, "provider should be "credentials". This made me wonder if I had a CORS issue and because I am using <code>Microsoft.AspNetCore.Cors</code> and not the ServiceStack CORS feature that <code>Access-Control-Allow-Credentials</code> is false and ServiceStack code is checking this value and the bear token will not be returned. This is my configuration using <code>Microsoft.AspNetCore.Cors</code></p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
          services.Configure&lt;DbSettings&gt;(options =&gt; Configuration.GetSection("DbSettings").Bind(options));
          services.AddTransient&lt;ITsoContext, TsoContext&gt;();
          services.AddTransient&lt;AuthService&gt;();
          services.AddCors(options =&gt;
          {
              options.AddPolicy("CorsPolicy",
                  builder =&gt; builder.AllowAnyOrigin()
                      .SetIsOriginAllowed(CorsHelper.IsOriginAllowed)
                      .AllowAnyMethod()
                      .AllowAnyHeader()
                      .AllowCredentials());
          });
      }
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          if (EnvironmentHelper.IsDevelopment(env.EnvironmentName) || EnvironmentHelper.IsLocalhost(env.EnvironmentName))
          {
              app.UseDeveloperExceptionPage();
  
          }
  
          app.UseCors("CorsPolicy");
  
          app.UseServiceStack(new AppHost(Configuration, env));
      }
  
  }
  </code></pre>
  
  <p>So disable my CORS configuration in my AUTH API and instead used ServiceStack CORS like so in AppHost.Configure method:</p>
  
  <pre><code>var corsFeature = new CorsFeature("*", "GET, POST, PUT, DELETE, PATCH, OPTIONS", "Content-Type", true);
  Plugins.Add(corsFeature);
  </code></pre>
  
  <p>The last boolean parameter sets <code>allowCredentials</code> to true.</p>
  
  <p>This results in HTTP OK responses which mean the credentials are good:
  <a href="https://i.stack.imgur.com/LfbNy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LfbNy.png" alt="enter image description here"></a></p>
  
  <p>But we have Preflight Request CORS issue:
  <a href="https://i.stack.imgur.com/uQvfL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uQvfL.png" alt="enter image description here"></a></p>
  
  <p>So when I whitelist my domains, set <code>allowCredentials</code> to true and add the <code>Authorization</code> allowedHeader:</p>
  
  <pre><code>Plugins.Add(new CorsFeature(allowOriginWhitelist: new[] {  "https://app.staging.mysite.com", "https://auth.staging.mysite.com" }, 
              allowedMethods: "GET, POST, PUT, DELETE, OPTIONS",
              allowCredentials: true,
              allowedHeaders: "Authorization, Content-Type"));
  </code></pre>
  
  <p>We are back to square one so to speak, successful authentication, using ServiceStack configure CORS but still no RefreshToken or BearerToken included in the response:</p>
  
  <p><a href="https://i.stack.imgur.com/iAsBY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iAsBY.png" alt="enter image description here"></a></p>
  
  <p>After more thought actually and <a href="http://50linesofco.de/post/2017-03-06-cors-a-guided-tour" rel="nofollow noreferrer">reading this article</a>, I am not so sure this is an API issue but perhaps this is a client CORS issue. I am using the ServiceStack Typescript client and mythz says right here credentials are included:</p>
  
  <p><a href="https://i.stack.imgur.com/S6osb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/S6osb.png" alt="enter image description here"></a></p>