I've got a really strange problem with Sharepoint Provider-hosted Add-in configuration, but only on production site.

I've got a frontend deployed to SiteAssets/home.js which is working fine, and the backend is on the Azure AppService. On the site collection i've got the Application (_layouts/15/AppNewReg.aspx) created and the .app package from visual studio installed to global app catalog + added to the site. When i'm calling the appService with ClientId from older deployment everything is working just fine, but when i generate a new ClientId, ClientSecret all i got from the appservice is a CORS ERROR. I need to create exact configuration from scratch, and remove the previous, so i cannot just stick with the old "Frontend APP A"

|                     | AppReg A       | AppReg  B      |
| AppService Code OLD | OK             | CORS Error     |
| AppService Code NEW | 500 Error      | CORS Error     |

Sharepoint DevTools Console Errors

There is a also a CORS error in the console

Access to XMLHttpRequest at 'https://xxx.sharepoint.com/sites/intra/layouts/15/AppRedirect.aspx?client_id=8c6c8d0f-28f7-4dfa-9ac0-b6bacc8be503&redirect_uri=https%3A%2F%2Fxxx.azurewebsites.net%2FFeedback%2FGetCountOfActiveTicketsForCurrentUser%3F%7BStandardTokens%7D%26IntraClient%3Df9e4fd3b-713c-47e0-8443-6c11b7abde84%26%3D1607450676287%26SPHasRedirectedToSharePoint%3D1' (redirected from 'https://xxx.azurewebsites.net/Feedback/GetCountOfActiveTicketsForCurrentUser?IntraClient=f9e4fd3b-713c-47e0-8443-6c11b7abde84&SPHostUrl=https%3A%2F%2Fxxx.sharepoint.com%2Fsites%2Fintra&_=1607450676287') from origin 'https://xxx.azurewebsites.net' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. xxx.azurewebsites.net/Scripts/jquery-3.1.1.js:9536

1 Answer 1


The solution found by comparing the tho HTTP Flows in the browser (using Teleriks Fiddler) was to enable cookies on the AppService O_O

<httpCookies sameSite="None" requireSSL="true"/>
<sessionState cookieSameSite="None" />

Azure AppService COde Editor Web.confg

Fiddler Request difference

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.