weird behavior on Post requests

[SamSabor]

I'm facing this weird behavior.
I've got an Angular web site and the preflight query return that méthode PUT is Allowed. But when the query is sent the response is "405 Method Not Allowed".
The others queries works fine
We use .net 8, and the ocelot Gateway is hosted by IIS.
asking directy the same endpoint back (https) works

Mi configuration:
{
"GlobalConfiguration": {
"BaseUrl": "https://gateway_uri-dns-name",
"CorsOptions": {
"AllowedOrigins": ["https://anguar-front-uri-dns-name"],
"AllowedMethods": ["GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"],
"AllowedHeaders": [""],
"ExposeHeaders": [""],
"MaxAge": 3600,
"SslOptions": {
"DangerousAcceptAnyServerCertificateValidator": true
}
}
},
"Routes": [
{

  "DownstreamPathTemplate": "/api/nomad/v1/{everything}",
  "DownstreamScheme": "http",
  "DownstreamHostAndPorts": [
    {
      "Host": "backend-dns-name",
      "Port": 10082
    }
  ],
  
  "UpstreamPathTemplate": "/gateway/api/nomad/v1/{everything}",
  "UpstreamHttpMethod": [ "GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH" ],
  "AuthenticationOptions": {
    "AuthenticationProviderKey": "Bearer",
    "AllowedScopes": []
  }
}

]
}
mi implémentation of Ocelot:

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;
using NLog;
using NLog.Web;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;
using System.Diagnostics;
using System.Linq;

var logger = NLog.LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
logger.Info("starting ");

var builder = WebApplication.CreateBuilder(args);

IConfiguration config = builder.Configuration;

// NLog: Setup NLog for Dependency injection
builder.Logging.ClearProviders();
builder.Host.UseNLog();

string? auth_provider = config["auth_provider"];
string? settingsFile = config["appsettings"];
string? ocelotConfFile = config["ocelot_Conf_file"];
var allowedOrigins = builder.Configuration.GetSection("CorsSettings:AllowedOrigins").Get<string[]>();

logger.Info($"auth_provider = {auth_provider}");
logger.Info($"settingsFile = {settingsFile}");
logger.Info($"ocelotConfFile = {ocelotConfFile}");

if (string.IsNullOrEmpty(ocelotConfFile) || allowedOrigins?.Length == 0)
{
throw new Exception("Erreur de configuration");
}

foreach (var oneOrigin in allowedOrigins)
{
logger.Info($"allowedOrigins = {oneOrigin}");
}

builder.Services.AddCors(options =>
{
options.AddPolicy("CorsPolicy", builder => builder
.WithOrigins(allowedOrigins)
.AllowAnyHeader()
.AllowAnyMethod()
.AllowCredentials()
.SetIsOriginAllowedToAllowWildcardSubdomains());
});

// Ajoutez les services d'authentification JWT
builder.Services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})

.AddJwtBearer(options =>
{
options.Authority = auth_provider;
options.Audience = "account";
options.RequireHttpsMetadata = false;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true
};
});

//conf Ocelot
builder.Configuration.AddJsonFile(ocelotConfFile, optional: false, reloadOnChange: true);
builder.Services.AddOcelot(builder.Configuration);

var app = builder.Build();

app.UseCors("CorsPolicy");

app.UseAuthentication();

await app.UseOcelot();

try
{
app.Run();
}
catch (Exception ex )
{
logger.Fatal(ex, "Erreur fatale de l'application");
throw;
}
preflight query

effectif query

trace :

[SamSabor]

I found the reason, an IIS WebDav module that breaks some gateway behavior.

[raman-m]

Congrats! 🥳

We use .net 8, and the ocelot Gateway is hosted by IIS.

IIS can be a challenging environment. Our documentation on IIS Gotchas provides insights 😉
Hosting an app in IIS without substantial IIS DevOps experience is not recommended. Ocelot is optimized for self-hosted environments using Kestrel web server, including Docker, containerization, cloud services, and traditional in-memory self-hosting such as console applications or terminal sessions.