Web API CORS OPTION returns 500 randomly only on azure

Question

Im developing a .NET Web Api (using OWIN) and a ember app consuming the web api. The web api is hosted on azure (api app). The problem is that sometimes the option call is failing (500 error) and the gui hangs. If I triggers the option call again it works again. If Im running the api on my local IIS, this problem never happens. The problem occurs most often when I have not done anything/triggered any ajax calls in the web app for awhile (5 min). Any clue why this is happening?

This is my startup config:

public partial class
    Startup
{
    public void Configuration(IAppBuilder app)
    {
        //enable cors
        app.UseCors(CorsOptions.AllowAll);


        //enable hangfire
        Hangfire.GlobalConfiguration.Configuration
            .UseSqlServerStorage("DbConnection")
            .UseActivator(new StructureMapJobActivator(IoC.Initialize()));

        app.UseHangfireDashboard();
        app.UseHangfireServer();

        //automapper
        AutoMapperBootstrapper.Bootstrap();

        //oauth 2
        var userManager = new UserManager();

        var authConfig = new SentinelAuthorizationServerOptions()
            {
                UserManager = userManager,
                ClientManager = new ClientManager(),
            };

        var shaProvider = new SHA2CryptoProvider();

        var onBoardTokenRepository = new OnBoardTokenRepository(new ConnectionFactory(new Configuration()), "DbConnection");
        authConfig.TokenManager = new TokenManager(LogManager.GetLogger<Startup>(), userManager, new PrincipalProvider(shaProvider), shaProvider, new TokenFactory(), onBoardTokenRepository);

        app.UseSentinelAuthorizationServer(authConfig);

        GlobalConfiguration.Configure(WebApiConfig.Register);
    }

I found this error in the azure event log:

   https://microsoft-apiapp08044e6364624e2e88cfda954ace012a.azurewebsites.net:443/job/getemployerjobs/job/getemployerjobs104.45.82.120FalseIIS APPPOOL\Microsoft-ApiApp08044e6364624e2e88cfda954ace012a108IIS APPPOOL\Microsoft-ApiApp08044e6364624e2e88cfda954ace012aFalse   at System.Web.HttpHeaderCollection.SetHeader(String name, String value, Boolean replace)
   at System.Web.HttpHeaderCollection.Set(String name, String value)
   at Microsoft.Owin.Host.SystemWeb.CallHeaders.AspNetResponseHeaders.Set(String key, String[] values)
   at Microsoft.Owin.Host.SystemWeb.CallHeaders.AspNetResponseHeaders.set_Item(String key, String[] value)
   at Microsoft.Owin.Infrastructure.OwinHelpers.SetHeaderUnmodified(IDictionary`2 headers, String key, String[] values)
   at Microsoft.Owin.Infrastructure.OwinHelpers.AppendHeaderUnmodified(IDictionary`2 headers, String key, String[] values)
   at Microsoft.Owin.HeaderDictionary.AppendValues(String key, String[] values)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationProvider.<.ctor>b__2(OAuthChallengeContext context)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationProvider.ApplyChallenge(OAuthChallengeContext context)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.ApplyResponseChallengeAsync()
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseCoreAsync>d__b.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseAsync>d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<TeardownAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Mapping.MapMiddleware.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Cors.CorsMiddleware.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContextStage.<RunApp>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.<DoFinalWork>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult ar)
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.EndFinalWork(IAsyncResult ar)
   at System.Web.HttpApplication.AsyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Answer 1

It seems this is related to Microsofts OWIN implementation: http://katanaproject.codeplex.com/discussions/540202 .

The relevant pull request is here: https://katanaproject.codeplex.com/workitem/263

The underlying OWIN OAuth middleware sometimes "seals off" the response when it creates a response.