title: Problem when protecting API with identity server - not working after login in Angular
body: <p>I am trying to protect an API in .net Core 2.0 with identity server, the UI was done with Angular, I think I already have done most of the job but after login in angular i can see this error in the console: </p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at
    '<a href="https://localhost:44375/connect/authorize?client_id=js&amp;redirect_uri=http%3A%2F%2Flocalhost%3A58906%2Fsignin-oidc&amp;response_type=id_token%20token&amp;scope=openid%20profile%20roles%20api1%20offline_access&amp;response_mode=form_post&amp;nonce=636939599510409570.MGYzMTFjMzItZmUyMC00ODU3LTg4ZjctM2U4MmI0NzAzMGZlNGE3YTNmODEtNzkyNi00MDViLTgxY2MtYWQ0ZjYxZmU0NWJm&amp;state=CfDJ8O2EEtV_W31JlCz9gl525Qd1Jg8V7r2jAMhzD_Q_VVDwSnlzrivuvFibSJD1WOjL_gueXbDQIQd8A3zpDTGQ5cQofWOyiWfCuEMJG361u6mJM1PCGKF0W0O40sfhv698VRw6m1z0lJklAaAx27g4MbdSLiq3WcCcpfX-Q30Hy3DFRyRuT-calMfySkYfyejpptDyBGb2uv-rP4D9vEHBRvyRS3Cq60VqSTn7-r_bpA52xM7vG0UFbEqQ4EMqAW2S2-6I1ccqKDJat8eKBo9p8jmp6YoOjCv3wcGKY1RPJz7b-Auu7xIPQwm2FeJ2j-LQF_v6ao2VY7fm4SW7CnNAinNJwaRtDOOxbNqPhjVOvayPJc2BR79Uitf2KaSUFg11Xv-llTuEv9aInJJRL2V1ZYH72iTp8jhndThWNFNtDpBU&amp;x-client-SKU=ID_NETSTANDARD1_4&amp;x-client-ver=5.2.0.0" rel="nofollow noreferrer">https://localhost:44375/connect/authorize?client_id=js&amp;redirect_uri=http%3A%2F%2Flocalhost%3A58906%2Fsignin-oidc&amp;response_type=id_token%20token&amp;scope=openid%20profile%20roles%20api1%20offline_access&amp;response_mode=form_post&amp;nonce=636939599510409570.MGYzMTFjMzItZmUyMC00ODU3LTg4ZjctM2U4MmI0NzAzMGZlNGE3YTNmODEtNzkyNi00MDViLTgxY2MtYWQ0ZjYxZmU0NWJm&amp;state=CfDJ8O2EEtV_W31JlCz9gl525Qd1Jg8V7r2jAMhzD_Q_VVDwSnlzrivuvFibSJD1WOjL_gueXbDQIQd8A3zpDTGQ5cQofWOyiWfCuEMJG361u6mJM1PCGKF0W0O40sfhv698VRw6m1z0lJklAaAx27g4MbdSLiq3WcCcpfX-Q30Hy3DFRyRuT-calMfySkYfyejpptDyBGb2uv-rP4D9vEHBRvyRS3Cq60VqSTn7-r_bpA52xM7vG0UFbEqQ4EMqAW2S2-6I1ccqKDJat8eKBo9p8jmp6YoOjCv3wcGKY1RPJz7b-Auu7xIPQwm2FeJ2j-LQF_v6ao2VY7fm4SW7CnNAinNJwaRtDOOxbNqPhjVOvayPJc2BR79Uitf2KaSUFg11Xv-llTuEv9aInJJRL2V1ZYH72iTp8jhndThWNFNtDpBU&amp;x-client-SKU=ID_NETSTANDARD1_4&amp;x-client-ver=5.2.0.0</a>'
    (redirected from
    '<a href="http://localhost:58906/api/ClienteES/ConsultarClientes?CantidadRegistros=30&amp;PaginaActual=1" rel="nofollow noreferrer">http://localhost:58906/api/ClienteES/ConsultarClientes?CantidadRegistros=30&amp;PaginaActual=1</a>')
    from origin 'null' has been blocked by CORS policy: Response to
    preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource.</p>
  </blockquote>
  
  <p>I already registered the clients in the identity server project, and I also did the setup in angular an in the API.</p>
  
  <p>this is the code in the Startup.cs in the API</p>
  
  <pre><code>        services.AddAuthentication(options =&gt;
          {
              options.DefaultScheme = "cookie";
              options.DefaultChallengeScheme = "oidc";
          })
          .AddCookie("cookie")
          .AddOpenIdConnect("oidc", options =&gt;
          {
              options.Authority = "https://localhost:44375/";
              options.ClientId = "ApiPrincipal";
              options.ClientSecret = "mysecret";
              options.SignInScheme = "cookie";
              options.SaveTokens = true;
              options.ResponseType = "code id_token";
              options.Scope.Add("openid");
              options.Scope.Add("profile");//
              options.Scope.Add("offline_access");
  
          });
  </code></pre>
  
  <p>--this is the configuration in angular--</p>
  
  <pre><code>authority: 'https://localhost:44375/',
  client_id: 'js',
  redirect_uri: 'http://localhost:4200/auth-callback',
  post_logout_redirect_uri: 'http://localhost:4200/',
  response_type: "id_token token",
  scope: "openid profile api1 roles offline_access",
  filterProtocolClaims: true,
  loadUserInfo: true
  </code></pre>
  
  <p>an these are the clients in the identity server project(.net core)
  new Client</p>
  
  <p>--client fot angular --</p>
  
  <pre><code>        {
              ClientId = "js",
              ClientName = "JavaScript Client",
              AllowedGrantTypes = GrantTypes.Implicit,
              AllowAccessTokensViaBrowser = true,
              AccessTokenLifetime = 151200,
              RequireConsent = false,
              RedirectUris = redirects.RedirectUris,
              PostLogoutRedirectUris = redirects.PostLogoutRedirectUris,
              AllowedCorsOrigins = redirects.AllowedCorsOrigins,
              AllowedScopes =
                  {
                      StandardScopes.OpenId.Name,
                      StandardScopes.Profile.Name,
                     // StandardScopes.Roles.Name,
                     "roles",
                      StandardScopes.OfflineAccess.Name,
                      "api1"
                  }
          }
  </code></pre>
  
  <p>--client for API--</p>
  
  <pre><code>            {
                  ClientId = "ApiPrincipal",
                  ClientName = "Cliente utilizado por el api principal de Mawa",
                  RequireConsent = false,
                  ClientSecrets = new List&lt;Secret&gt; { new Secret("mysecret".Sha256()) },
                  AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                  //AllowRememberConsent = true,
                  AlwaysSendClientClaims=true,
                  AllowedScopes = new List&lt;string&gt;
                  {
                      StandardScopes.OpenId.Name,
                      StandardScopes.Profile.Name,
                      StandardScopes.OfflineAccess.Name//,
                      //"ApiAuditor"
                  },
                  //RedirectUris = new List&lt;string&gt; { "http://localhost:1424/signin-oidc" },//MTA
                  //PostLogoutRedirectUris = new List&lt;string&gt; { "http://localhost:1424/" }//MTA
                  RedirectUris = new List&lt;string&gt; { "http://localhost:58906/signin-oidc" },//Pemarsa
                  PostLogoutRedirectUris = new List&lt;string&gt; { "http://localhost:58906/" }//Pemarsa
               }
  </code></pre>
  
  <p>I want to login in angular and I want the API to recognize that so I can validate the permissions but so far I have been unable to.</p>