title: Unable to enable CORS in WebAPI 2
body: <p>This is driving me nuts and I apologise if it's a duplicate but I've read through all the other WebAPI/CORS questions and can't find any configuration that works.  </p>
  
  <p>I have a WebAPI 2 project on .NET 4.6.1 which runs perfectly - controllers all initialise etc, etc.  I can call the different actions directly and all is fine.</p>
  
  <p>However, when I try to call the API from another website I know I need to use CORS to enable this otherwise i get the 500 server error / pre-flight errors.</p>
  
  <p>So I installed <strong>System.Web.Http.Cors</strong> and did this as instructed in my <strong>WebApiConfig</strong>:</p>
  
  <pre><code>var cors = new EnableCorsAttribute("*", "*", "*");
  config.EnableCors(cors);
  config.MapHttpAttributeRoutes();
  app.UseWebApi(config);
  </code></pre>
  
  <p>I would expect all ApiControllers and actions to respond to an OPTIONS request.  I can see my ajax request making the OPTIONS request but I get an internal server error from WebAPI:</p>
  
  <pre><code>Request URL:http://localhost:55579/api/event?start=2017-06-01&amp;end=2017-06-30
  Request Method:OPTIONS
  Status Code:500 Internal Server Error
  Remote Address:[::1]:55579
  Referrer Policy:no-referrer-when-downgrade
  </code></pre>
  
  <p>...and making a direct OPTIONS call via Postman gives me:</p>
  
  <pre><code>{
      "$id": "1",
      "message": "The requested resource does not support http method 'OPTIONS'."
  }
  </code></pre>
  
  <p>I have also tried adding the attribute to my controller but this has no effect either.</p>
  
  <pre><code>[RoutePrefix("api/event")]
  [EnableCors(origins: "*", headers: "*", methods: "*")]
  public class EventController : ApiController
  </code></pre>
  
  <p>What am I missing here?</p>