Published on webserver core8 api works from POSTMAN and from weserver published frontend but ERR_CONNECTION_RESET from client browser

Question

I was trying to explain everything on the subject, but here's my problem: I have a webApi developed with netcore 8, published on a windows server 2012 with IIS 8, and an Angular 15 frontend, hosted on the same webserver. If I try to access the webapi with PostMan, all works correctly and the response is sent back with everything i need. If i try to access the webapi using the Angular client directly with a browser on the webserver, it works correctly (the request is from a login form). If i try to access the webapi using the Angular client from a client browser i have an error in the console "ERR_CONNECTION_RESET". I tried with different browser from different clients: same error.

The original web.config of the API is the following:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <location path="." inheritInChildApplications="false">
        <system.webServer>
            <handlers>
                <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
            </handlers>
            <aspNetCore processPath=".\WebApi.exe" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" hostingModel="inprocess" />
        </system.webServer>
    
    </location>
</configuration>

Any guess?

P.S.: The webApi was originally written for netcore7 and worked on the same environment without any problem

I have tried a more complex version of web.config as follow:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <location path="." inheritInChildApplications="false">
        <system.webServer>
            <handlers>
                <remove name="WebDAV" />
                <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
                <remove name="OPTIONSVerbHandler" />
                <remove name="TRACEVerbHandler" />
                <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
                <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
            </handlers>
            <modules runAllManagedModulesForAllRequests="true">
                <remove name="WebDAVModule" />
                <remove name="ApplicationInsightsWebTracking" />
                <add name="ApplicationInsightsWebTracking" type="Microsoft.ApplicationInsights.Web.ApplicationInsightsHttpModule, Microsoft.AI.Web" preCondition="managedHandler" />
            </modules>
            <aspNetCore processPath=".\WebApi.exe" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" hostingModel="inprocess" />
            <httpProtocol>
                <customHeaders>
                    <add name="Access-Control-Allow-Headers" value="Content-Type,Authorization"/>
                    <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS"/>
                </customHeaders>
            </httpProtocol>
        </system.webServer>
    
    </location>
</configuration>

But still doesn't work.

More information: in the webapi startup i added the UseUrls("https://*:4000") in the appsettings of the webapi i have specified a "AppURL" : "https://webserverName/:4000" that is the same used in the app.config of the angular client: "apiEndpoint":"https://webserverName:4000/".

The Angular client run on http, while the webApi run on https (with self signed SSL cert).

Answer 1

In the end I resolved my own problem that was, indeed, a CORS problem.

My frontend was running using http while my service was running on https. Switching to http my service (not wanting to deal with certificates) did the trick.

I guess I need to go more deeply into CORS