title: “No 'Access-Control-Allow-Origin' header is present” for redirected request to https://login.microsoftonline.com/
body: <p>I'm trying to get response with an access code and getting:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load "h...://login.microsoftonline.com/d331431b-899c-4666-8094-e82e6bfc3964/oaut…auth%2faad&amp;scope=user_impersonation&amp;state=033f4ad89a574135884fd3a03c1743ab". No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://localhost:23589" rel="nofollow">http://localhost:23589</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>Used all suggestions from <strong>the ServiceStack, CORS, and OPTIONS (No Access-Control-Allow-Origin header)</strong> discussion:</p>
  
  <p>added:</p>
  
  <pre><code>Plugins.Add(new CorsFeature(new[] { "http://localhost/", "http://localhost:23589" },
              allowCredentials: true,
              allowedHeaders: "Content-Type, Allow, Authorization"));
  </code></pre>
  
  <p>and even:</p>
  
  <pre><code>PreRequestFilters.Add((httpReq, httpRes) =&gt;
  {
       //if (httpReq.Verb == "OPTIONS")
       //{
       //    var origin = httpReq.Headers.Get("Origin");
       string origin = httpReq.Headers.Get("Origin");
       httpRes.AddHeader(HttpHeaders.AllowOrigin,  "*");
       httpRes.EndRequest();
       // }
  });
  </code></pre>
  
  <p>Still no luck. We are using ServiceStack version 4.0.56</p>
  
  <p><strong>Request URL</strong>:</p>
  
  <p><em>> <a href="https://login.microsoftonline.com/d331431b-899c-4666-8094-e82e6bfc3964/oauth2/authorize?response_type=code&amp;resource=https%3a%2f%2fanalysis.windows.net%2fpowerbi%2fapi&amp;client_id=0d3be5ed-3361-43f5-9d25-a5ccefb11f7e&amp;redirect_uri=http%3a%2f%2flocalhost%3a23589%2fapi%2fauth%2faad&amp;scope=user_impersonation&amp;state=d6ef09f8064643ed914d4995562642be" rel="nofollow">https://login.microsoftonline.com/d331431b-899c-4666-8094-e82e6bfc3964/oauth2/authorize?response_type=code&amp;resource=https%3a%2f%2fanalysis.windows.net%2fpowerbi%2fapi&amp;client_id=0d3be5ed-3361-43f5-9d25-a5ccefb11f7e&amp;redirect_uri=http%3a%2f%2flocalhost%3a23589%2fapi%2fauth%2faad&amp;scope=user_impersonation&amp;state=d6ef09f8064643ed914d4995562642be</a></em></p>
  
  <pre><code>Request Method:GET
  Status Code:200 OK
  Remote Address:157.55.208.218:443
  </code></pre>
  
  <h3>Response Headers:</h3>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-cache, no-store
  Pragma: no-cache
  Content-Type: text/html; charset=utf-8
  Content-Encoding: gzip
  Expires: -1
  Vary: Accept-Encoding
  Server: Microsoft-IIS/8.5
  x-ms-request-id: d2531fb2-2e97-4940-a15d-f3c6f1cd5e7b
  client-request-id: 376b2cb0-e1d2-4749-a8b5-adfee1b3ceba
  X-Frame-Options: DENY
  x-ms-gateway-service-instanceid: ESTSFE_IN_344
  X-Content-Type-Options: nosniff
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
  Set-Cookie: buid=AAABAAEAiL9Kn2Z27UubvWFPbm0gLfvzURnxA_SU_2fqg40MIAq5oFqJPcrl7iSuhLgh52CsEbHynIx5Krpov-SlQ7tVxK9O3EWPdKHzur0dQHXgfE4FLI6Vmv3-HwokZIpKbXA2IAA; expires=Fri, 02-Dec-2016 17:25:56 GMT; path=/; secure; HttpOnly
  Set-Cookie: esctx=AAABAAAAiL9Kn2Z27UubvWFPbm0gLdbqNasFxQzD3cBv92w234pND-QPmCQNU9pfwexBLi9fullMTJbXyFHlgwaIpWQHx6OpBt9rHaIVDwlxaAh7MqFmsrHiMcoXcWy55B0veMpU10kthlQdtj37nLx1_p3ocBF3tMJ822MGbR2D-Epr8iTW2AmiL46Q2oxA9gHfuwYBIAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly
  Set-Cookie: x-ms-gateway-slice=productiona; path=/; secure; HttpOnly
  Set-Cookie: stsservicecookie=ests; path=/; secure; HttpOnly
  X-Powered-By: ASP.NET
  Date: Sun, 05 Jun 2016 17:25:55 GMT
  Content-Length: 9602
  </code></pre>
  
  <h3>Request Headers:</h3>
  
  <pre><code>Accept:application/json, text/plain, */*
  Accept-Encoding:gzip, deflate, sdch, br
  Accept-Language:en-US,en;q=0.8,ru;q=0.6
  Cache-Control:max-age=0
  Connection:keep-alive
  Host:login.microsoftonline.com
  Origin:http://localhost:23589
  Referer:http://localhost:23589/
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
  </code></pre>
  
  <p>I also tried adding this code in AppHost Confugure method:</p>
  
  <pre><code> base.SetConfig(new HostConfig
              {
                  GlobalResponseHeaders = {
                      { "Access-Control-Allow-Origin", "*" },
                      { "Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS" },
                      { "Access-Control-Allow-Headers", "Content-Type" },
                  },
              });
  </code></pre>
  
  <h2>From Fiddler:</h2>
  
  <h3>Request headers:</h3>
  
  <pre><code>GET /d331431b-899c-4666-8094-e82e6bfc3964/oauth2/authorize?response_type=code&amp;resource=https%3a%2f%2fanalysis.windows.net%2fpowerbi%2fapi&amp;client_id=0d3be5ed-3361-43f5-9d25-a5ccefb11f7e&amp;redirect_uri=http%3a%2f%2flocalhost%3a23589%2fapi%2fauth%2faad&amp;scope=user_impersonation&amp;state=3c41d4ea46a8408fb19fdf05ea07643a HTTP/1.1
  Host: login.microsoftonline.com
  Connection: keep-alive
  Cache-Control: max-age=0
  Accept: application/json, text/plain, */*
  Origin: http://localhost:23589
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
  Referer: http://localhost:23589/
  Accept-Encoding: gzip, deflate, sdch, br
  Accept-Language: en-US,en;q=0.8,ru;q=0.6
  </code></pre>
  
  <h3>Response Headers:</h3>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-cache, no-store
  Pragma: no-cache
  Content-Type: text/html; charset=utf-8
  Expires: -1
  Vary: Accept-Encoding
  Server: Microsoft-IIS/8.5
  x-ms-request-id: 70fcd73f-f880-4744-b896-6edc491b1d22
  client-request-id: a52446b6-a7f0-4afb-ba23-8d27207ddb27
  X-Frame-Options: DENY
  x-ms-gateway-service-instanceid: ESTSFE_IN_19
  X-Content-Type-Options: nosniff
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
  Set-Cookie: buid=AAABAAEAiL9Kn2Z27UubvWFPbm0gLWnOYMRRqrZRDzgogkab1uuAetOi-f1iLnpE1G5EU3xMkzYdvTgIs2Fz79S07PNcfnEry6eWS8RX_4k8awcIgY063VQ7VvWP6SRRvXfCgpJeIAA; expires=Fri, 02-Dec-2016 22:20:48 GMT; path=/; secure; HttpOnly
  Set-Cookie: esctx=AAABAAAAiL9Kn2Z27UubvWFPbm0gLZemnOQ8vijuCpi6h8NzV-CjOfr0MZwZhb4Nfczf20C1TSXORoJbIHCbVBV_MmeuXTR1mbzh9GzFIBmi__ff0M-gGh02fol-sHPyKJnU7Zfi2cEYWensHvmiEJO9Tw5KbO8tWdZxl-XDi7V5IZNNsJWp4LxTVVGkOeyOYieMfJ6mIAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly
  Set-Cookie: x-ms-gateway-slice=productiona; path=/; secure; HttpOnly
  Set-Cookie: stsservicecookie=ests; path=/; secure; HttpOnly
  X-Powered-By: ASP.NET
  Date: Sun, 05 Jun 2016 22:20:49 GMT
  Content-Length: 36210
  </code></pre>