Rick Strahl

Nice article, though it doesn't cover CORS with NTLM/Kerberos auth (ie. .NET on windows).

To my mind this is the most baffling aspect here, as preflight requests shouldn't carry an auth token (according to the spec), however IIS is an all-or-nothing auth which will thus reject the preflight request, unless it is specifically handled.

Additionally, there are different ways to handle preflighting for owin and aspnetcore vs .NET framework (IIS hosting), and these methods also change depending on the technology - MVC, WebAPI, OData.

[edit] Hit return early:

MVC (pure) requests can be handled in the web.config to set custom headers.
WebAPI uses annotations on the controllers.
See https://stackoverflow.com/questions/29970793/enabling-cors-through-web-config-vs-webapiconfig-and-controller-attributes

OData follows a different path through, so the above won't work. You would need to modify Application_BeginRequest()
See https://stackoverflow.com/questions/31459416/how-to-enable-cors-via-attribute-instead-of-via-application-beginrequest-when-pr

The above is all for .NET framework (IIS host). For OWIN you need to modify HttpListener as per https://stackoverflow.com/questions/42104716/owin-preflight-requests-are-not-processed

For aspnetcore the pipeline again changes:
https://weblog.west-wind.com/posts/2016/Sep/26/ASPNET-Core-and-CORS-Gotchas

Lastly, all of the above should be using xhr.withCredentials = true; on the client (javascript) side.

Note that this is not present for…

I've encountered the problem he describes in WinUI, too. It can happen in any toolkit where you bind to change events of "observables". In my case I had a list view and a details view, and when you pressed down in the list view, it would get janky and struggle to update the detail view in time. To make it worse, sometimes selecting a different row would hit off a HTTP request in the background to update some cached data.

I ended up implementing a similar rate limiter, I think based on this here: https://weblog.west-wind.com/posts/2017/Jul/02/Debouncing-and-Throttling-Dispatcher-Events (I've never shipped it though.)

The art is to get the behavior just right. You want the first request to go through immediately, so on a single click the user sees low latency. But afterwards you need to throttle it so that it only updates every, say, 500 ms. And you must not forget to display the very latest state, if there is no new event after e.g. 50 ms.

This seems like one of those things that are really hard to get right and the toolkit developer should have solved for you. I've struggled with it a couple of times now.

> Just hitting the windows key and typing "notepad" and hitting enter has gone from something that was near instant in windows XP to something that takes 30 seconds and only sometimes might be successful

Agreed. It's also surprisingly easy to fix - disable web search in the start menu. [0]

> Because as horrible as defender is, have you experienced commercial AV products?

yes, and they're a disgrace. I don't normally engage in baiting on here, but honestly a lot of them are worse than the viruses they protect you from. McAfee and Norton are _literally_ spyware.

At $PREV_JOB carbon black was installed over the weekend, and I was working on some performance related tasks. All my results were invalidated because of the slowdown it imparted on _everything_.

That doesn't give defender a free pass for falling from grace though.

[0] https://weblog.west-wind.com/posts/2024/May/03/Speed-up-your-Start-Menu-by-disabling-Web-Search

If you try to do it in one big hit it will be hard but you don't have to do that. You can move it over piecemeal.

You can use multi-targeting to move parts of your code over to .NET Standard. So if you start with your base projects and move your way up, gradually your code will become compatible between .NET core and .NET Framework. This will help you remove any .NET Full Framework / Windows specific bits. Where you have to have things that are specific to each OS you can then just configure your DI so it will inject the Windows specific / Linux specific implementation.

For those that are not aware of multi-targeting here is a great article on it:

https://weblog.west-wind.com/posts/2017/Jun/22/MultiTargeting-and-Porting-a-NET-Library-to-NET-Core-20