[HttpPost("IsAuthenticated")]
public IActionResult IsAuthenticated([FromBody] IsAuthenticatedRequest request) {
 var hash = _userService.IsAuthenticated(HttpContext, request);
 switch (hash) {
  case "200":
  case "401":
     return new StatusCodeResult(Convert.ToInt32(hash));
  default:
     if (HttpContext.Request.Cookies.Contains("TEST")) {
        HttpContext.Response.Cookies.Delete("TEST");
     }
     HttpContext.Response.Cookies.Append("Test", hash, new CookieOptions() {
         HttpOnly = true,
         Secure = true,
         IsEssential = true,
         Domain = "localhost",
         Expires = new DateTimeOffset(DateTime.Now).AddMinutes(20.0)
    });
    return new StatusCodeResult(200);
 }
}

{
  "/api/*": {
    "target": "https://localhost:5001",
    "secure": false,
    "topLevel": "debug",
    "changeOrigin": true
  },
  "/login.html": {
    "target": "http://localhost:4200/assets/pages",
    "secure": false
  },
  "/": {
    "target": "http://localhost:4200",
    "secure": false
  }
}

var paramString = "{username: "test", password: "test"}";
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
  if (this.readyState == 4 && this.status == 200) {
    window.location.href = "/";
  } else if (this.status == 401) {
    alert("1");
  }
};
xhttp.open("POST", "/api/UserService/IsAuthenticated", true);
xhttp.withCredentials = true;
xhttp.setRequestHeader("Content-type", "application/json-patch+json");
xhttp.setRequestHeader("Access-Control-Allow-Origin", "*");
xhttp.setRequestHeader("Access-Control-Allow-Credentials", "true");
xhttp.send(paramString);