After a seamlessly flawless upgrade to ASP.NET Core, we got into trouble when using SignalR hubs.
In our code we were rather lazy and had allowed CORS for everything:
In ASP.NET Core 2.2 it is no longer allowed to combine AllowAnyOrigin and AllowCredentials. When you try to use the two together, you‘ll see the following warning in the output window:
warn: Microsoft.AspNetCore.Cors.Infrastructure.CorsService
The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the policy by listing individual origins if credentials needs to be supported.
Problem is that this warning breaks the preflight OPTIONS check of SignalR and the client can no longer connect to the hubs.
To fix this, you have to remove the AllowAnyOrigin method and instead specify the origins explicitly(like it should be in the first place):