Sever cannot set status after HTTP headers have been sent when doing CORS

[jstralko]

Hello,

I'm getting this stacktrace when doing an CORS ajax call: [HttpException (0x80004005): Server cannot set status after HTTP headers have been sent.] System.Web.HttpResponse.set_StatusCode(Int32 value) +9837007 Devbridge.BasicAuthentication.BasicAuthenticationModule.IssueAuthenticationChallenge(Object source, EventArgs e) in Devbridge.BasicAuthentication\BasicAuthenticationModule.cs:149 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +141 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

I'm unclear if this is an issue with devbridge or is there something i need to configure in my application. My application is a web project using System.Web.Http.ApiController. My CORS settings were working using the Visual Studio IIS Instance, but when I deployed it to our azure environment running IIS and using this module, I'm getting that error and the ajax is failing.

Here is the request/response from Chrome Dev Tools:

Request URL:http://[url_of_server]/mtm-ws/get Request Method:GET Status Code:200 OK Remote Address:xx.xx.xx.xx:80 Response Headers Access-Control-Allow-Origin:* Cache-Control:no-cache Content-Encoding:gzip Content-Type:application/json; charset=utf-8 Date:Wed, 16 Nov 2016 17:32:55 GMT Expires:-1 Pragma:no-cache Server:Microsoft-IIS/8.0 Set-Cookie:ARRAffinity=55b6ce1591a0b1ae4902697d2eef16fc9b82765ddc65dff75d745025a4d740fe;Path=/;Domain=[url_of_server] Transfer-Encoding:chunked Vary:Accept-Encoding X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET Request Headers Accept:/ Accept-Encoding:gzip, deflate, sdch Accept-Language:en-US,en;q=0.8 Connection:keep-alive Host:cdilabs.azurewebsites.net Origin:http://localhost:3000 Referer:http://localhost:3000/mtm.html User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36

[mariusrybelis]

Hi Gerb,

Unfortunately we have not used BasicAuthenticationModule with CORS. Please create a pull request if you find a solution.

One more note - it seems that you are trying to protect your API with BasicAuthenticationModule. This module was created to be used for public facing websites. You should consider another options (like JWT) to secure your API.

Marius

[jstralko]

Marius,

Thank you for the suggestion. I'm just using basic auth for demo purposes since i've used the BasicAuthenticationModule before. I'll see if I can use get CORS working and will create a pull request. Yes I will eventually using JWT to properly secure my API.

Gerb