I have a backend written in c# dotnet that's using Negotiate as Authentication scheme. I have a frontend written in ts Angular. I'm making http requests from the frontend to the backend using angular's httpClient library. When I set withCredentials to true in the options of httpClient's function the requests works properly; when I omit that field I get 401. Both applications run on localhost but on different ports (so CORS has to be allowed). Everything works fine but my question is: why? By checking the browser's Network section I see that the headers of both requests are literally the same (I'd expect the cookie to be sent in the working request somewhere in the header), the difference is in backend's response: FE to BE request's headers OPTIONS /graphql HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Access-Control-Request-Headers: content-type Access-Control-Request-Method: POST Cache-Control: no-cache Connection: keep-alive Host: localhost:7009 Origin: http://localhost:4200 Pragma: no-cache Referer: http://localhost:4200/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site User-Agent: ... 401 request: HTTP/1.1 204 No Content Date: Thu, 28 Aug 2025 08:42:54 GMT Server: Kestrel Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: content-type Access-Control-Allow-Methods: POST Access-Control-Allow-Origin: http://localhost:4200 Authorized request: HTTP/1.1 200 OK Content-Type: application/json Date: Thu, 28 Aug 2025 08:42:26 GMT Server: Kestrel Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: http://localhost:4200 Transfer-Encoding: chunked WWW-Authenticate: Negotiate <string-of-random-chars> Also by checking browser's Application section I don't see any cookie stored, not for the frontend (being localhost:4200) nor for the backend (localhost:7009). Why are things working? Continue reading...
