kestrel | simple , distributed message queue system

No, the browser doesn't require the server to explicitly allow the POST method, because the latter, as a so-called CORS-safelisted method, gets a free pass.

The answer, as always, lies in the Fetch standard (section 4.8), which specifies how CORS works:

1. Let methods be the result of extracting header list values given Access-Control-Allow-Methods and response’s header list.

And further down:

1. If request’s method is not in methods, request’s method is not a CORS-safelisted method, and request’s credentials mode is "include" or methods does not contain *, then return a network error.

(my emphasis)

What is a CORS-safelisted method? The term is defined in section 2.2.1:

A CORS-safelisted method is a method that is GET, HEAD, or POST.

If the method of the CORS request is one of GET, HEAD, or POST, the browser doesn't require the server to explicitly list that method in the Access-Control-Allow-Methods header for CORS preflight to succeed.

I've found Jake Archibald's CORS playground useful for testing my (mis)understanding of CORS. Running this particular instance in your browser may convince you that the POST method doesn't need to be explicitly allowed for CORS preflight to succeed.

Microsoft don't provide support for .NET Core/.NET 5, since the SSRS library is intricately linked with WebForms, which are no longer supported.

Refer this link

Usually, we use NetworkCredential option to pass username and password while in ASP.NET MVC.

You can able to supply report server's username and password to ReportSettings.Credential as shown in below.

Configuration:

Use Series.dropna for remove NaNs and Nones:

Forget about everything you know about IIS.

For Apache or nginx, just run your ASP.NET Core console application (who initializes Core CLR) at a local port (http://localhost:5000 for example), and then set up reverse proxy rules to forward external traffic to that port.

That's roughly what Microsoft documented in this article

Such reverse proxy setup is common, as other web stacks (Node.js, Python, Go) are using the same approach.

Because of this specific setup, Linux launches your .NET Core console app by analyzing the COFF envelope (of dotnet executable, or your own executable for self contained deployment) to locate the native entry (not your managed Main).

Apache/nginx is not involved in anyway.

Calling into this entry triggers CoreCLR initialization, and in turn your managed assemblies are loaded and managed Main is called.

You might find articles like this helpful.

I managed to track down the cause and fix it.

1. Microsoft.AspNetCore.Authentication.JwtBearer actually makes not 1 but 2 calls to IdentityServer4: one to /.well-known/openid-configuration to get the configuration and then a call to the endpoint returned in jwks_uriof the previous response. The first call was to a localhost:port endpoint using the self signed certificate and working normally but the 2nd was to a realdomain endpoint using the Let's Encrypt certificate and failing with the error in the OP.
2. The Let's Encrypt certificate had an expired certificate in the chain: it was using DST Root CA X3 instead of ISRG Root X1 (more info here: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)

This can be achieved by changing the IdentityServer4 origin in Startup.cs:

I tried to reproduce your problem on new asp net core empty project and it works fine.

Perhaps Startup is missing some configuration.

Here's what I did.

csproj

The migration guide's code examples cover that. You should use UseKestrel on the builder's WebHost:

Sorry, It was my fail:(
I just forgot that docker-compose up -d command doesn't rebuild Docker images.
I removed all images, and run the command again.
With the configurations above it works fine for me!

Just use the version that MassTransit depends upon, which is much earlier than v13. Upgrading past that without the proper assembly redirects is likely causing your issue.