title: asp.net web api angular CORS preflight issue with POST requests
body: <p>I have a webapi which is configured to use WINDOWS AUTHENTICATION.</p>
  
  <pre><code>var cors = new EnableCorsAttribute(origen, "*", "*") { SupportsCredentials = true };
              config.EnableCors(cors);
  </code></pre>
  
  <p>In my angular app I have the follwing methods:</p>
  
  <p>GET methods work perfect.</p>
  
  <pre><code>result.CargarAreas = function (callBack, onError) {
  
          //url = WebApi + "Personas";
          var url = constants.apiPath + "Areas";
  
          //$http.get(url, { headers: { "Access-Control-Allow-Origin": constants.serverPath } })
          $http.get(url, {
              withCredentials: true
          })
          .then(function (data) {
              callBack(data);
          })
          .catch(function (data) {
              onError(data);
          });
      };
  </code></pre>
  
  <p>POST methods give me this error:</p>
  
  <pre><code>result.GuardarContacto = function (callBack, onError, data) {
  
          //url = WebApi + "Contactos";
          var url = constants.apiPath + "Contactos";
  
          $http.post(url, data, { headers: { "Access-Control-Allow-Origin": constants.serverPath } })
  
          .then(function (data) {
              callBack(data);
          })
          .catch(function (data) {
              onError(data);
          });
      };
  </code></pre>
  
  <p>and finally the web api method</p>
  
  <pre><code>[HttpGet]
          [Route("api/AutenticationSite")]
          public IHttpActionResult AutenticationSite()
          {
              string user = HttpContext.Current.Request.LogonUserIdentity.Name.ToString();
              string[] subUser = user.Split('\\');
              bool respuesta = UsuariosDao.Authorize(subUser[1]);
  
              if (respuesta == true)
              {
                  return Ok("Authenticated: " + user);
              }
              else
              {
                  return BadRequest("Not authenticated" );
              }
          }
  </code></pre>
  
  <p>and the DAMN error we have been fighting for hours:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="http://a.b.com/api/Contactos" rel="nofollow noreferrer">http://a.b.com/api/Contactos</a>. Response to
    preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://a.b.com" rel="nofollow noreferrer">http://a.b.com</a>' is
    therefore not allowed access. The response had HTTP status code 401.</p>
  </blockquote>
  
  <p>UPDATE 1</p>
  
  <p>Info about the request and response</p>
  
  <blockquote>
    <p>Request URL:<a href="http://a.b.com/api/Contactos" rel="nofollow noreferrer">http://a.b.com/api/Contactos</a> Request Method:OPTIONS Status
    Code:200 OK Remote Address:181.143.YY.XX:80 Referrer
    Policy:no-referrer-when-downgrade Response Headers  (11) Request
    Headers view source Accept:<em>/</em> Accept-Encoding:gzip, deflate, sdch
    Accept-Language:es-ES,es;q=0.8
    Access-Control-Request-Headers:content-type
    Access-Control-Request-Method:POST Cache-Control:no-cache
    Connection:keep-alive Host:a.b.com Origin:<a href="http://a.b.com" rel="nofollow noreferrer">http://a.b.com</a>
    Pragma:no-cache Referer:<a href="http://a.b.com/Index.html" rel="nofollow noreferrer">http://a.b.com/Index.html</a>
    User-Agent:Mozilla/5.0 (Windows NT 10.0</p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/zDIaY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zDIaY.png" alt="enter image description here"></a></p>