asp.net - OWIN token authentication 400 Bad Request on OPTIONS from browser -

asp.net - OWIN token authentication 400 Bad Request on OPTIONS from browser -

i using token authentication little project based on article: http://bitoftech.net/2014/06/09/angularjs-token-authentication-using-asp-net-web-api-2-owin-asp-net-identity/

everything seems work fine except 1 thing: owin based token authentication doesn't allow options request on /token endpoint. web api returns 400 bad request , whole browser app stops sending post request obtain token.

i have cors enabled in application in sample project. below code might relevant:

public class startup { public static oauthbearerauthenticationoptions oauthbeareroptions { get; private set; } public void configuration(iappbuilder app) { arearegistration.registerallareas(); unityconfig.registercomponents(); globalconfiguration.configure(webapiconfig.register); filterconfig.registerglobalfilters(globalfilters.filters); routeconfig.registerroutes(routetable.routes); bundleconfig.registerbundles(bundletable.bundles); httpconfiguration config = new httpconfiguration(); app.usecors(microsoft.owin.cors.corsoptions.allowall); configureoauth(app); webapiconfig.register(config); app.usewebapi(config); database.setinitializer(new applicationcontext.initializer()); } public void configureoauth(iappbuilder app) { //use cookie temporarily store info user logging in 3rd party login provider app.useexternalsignincookie(microsoft.aspnet.identity.defaultauthenticationtypes.externalcookie); oauthbeareroptions = new oauthbearerauthenticationoptions(); oauthauthorizationserveroptions oauthserveroptions = new oauthauthorizationserveroptions() { allowinsecurehttp = true, tokenendpointpath = new pathstring("/token"), accesstokenexpiretimespan = timespan.fromminutes(60), provider = new simpleauthorizationserverprovider(), refreshtokenprovider = new simplerefreshtokenprovider() }; // token generation app.useoauthauthorizationserver(oauthserveroptions); app.useoauthbearerauthentication(oauthbeareroptions); } }

below login function javascript (i using angularjs purpose)

var _login = function (logindata) { var info = "grant_type=password&username=" + logindata.username + "&password=" + logindata.password; info = info + "&client_id=" + ngauthsettings.clientid; var deferred = $q.defer(); $http.post(servicebase + 'token', data, { headers: { 'content-type': 'application/x-www-form-urlencoded' } }).success(function (response) { localstorageservice.set('authorizationdata', { token: response.access_token, username: logindata.username, refreshtoken: response.refresh_token, userefreshtokens: true }); _authentication.isauth = true; _authentication.username = logindata.username; _authentication.userefreshtokens = logindata.userefreshtokens; deferred.resolve(response); }).error(function (err, status) { _logout(); deferred.reject(err); }); homecoming deferred.promise; }; var _logout = function () { localstorageservice.remove('authorizationdata'); _authentication.isauth = false; _authentication.username = ""; _authentication.userefreshtokens = false; };

i've lost time on problem today. think i've found solution.

override method within oauthauthorizationserverprovider:

public override task matchendpoint(oauthmatchendpointcontext context) { if (context.istokenendpoint && context.request.method == "options") { context.owincontext.response.headers.add("access-control-allow-origin", new[] { "*" }); context.owincontext.response.headers.add("access-control-allow-headers", new[] { "authorization" }); context.requestcompleted(); homecoming task.fromresult(0); } homecoming base.matchendpoint(context); }

this appears 3 necessary things:

force auth server respond options request 200 (ok) http status, allow request come anywhere setting access-control-allow-origin allows authorization header set on subsequent requests setting access-control-allow-headers

after steps angular behaves correctly when requesting token endpoint options method. ok status returned , repeats request post method total token data.

asp.net angularjs owin asp.net-web-api2