Enable Access-Control-Allow-Credentials header in Azure website (Azure App Services)

We finally managed to understand the behavior of the Azure Apps CORS middleware. To disable it, you have to clear every single allowed origin entry in the CORS blade of your web app (including *). Then you can manage CORS by yourself, either using the Web Api 2 functionality or using the web.config.

The information is even available in the documentation:

Don't try to use both Web API CORS and App Service CORS in one API app. App Service CORS will take precedence and Web API CORS will have no effect. For example, if you enable one origin domain in App Service, and enable all origin domains in your Web API code, your Azure API app will only accept calls from the domain you specified in Azure.

So the final answer is: If your application does not need a very specific CORS management, you can use Azure App Service CORS. Otherwise you will need to handle it yourself and disable all CORS configuration in the web app.

This is now supported in the Azure App Service CORS feature. Unfortunately there is not a UX for it yet, so it is a little painful to enable. There are currently two straightforward methods.

1. On the Azure Portal, navigate to your Web App. Navigate to API > CORS. There is now a checkbox for Enable Access-Control-Allow-Credentials. Check this box and press Save.

2. Use the Azure CLI with the following command:

az resource update --name web --resource-group myResourceGroup --namespace Microsoft.Web --resource-type config --parent sites/<app_name> --set properties.cors.supportCredentials=true --api-version 2015-06-01

You can see more documentation here.

NOTE: This does not work with * as an allowed origin. This is a security choice we decided to make.