title: How to allow internal MVC Web Api from external site outside the network
body: <p>I have a MVC Web API (hosted in IIS) which is in the wwwroot folder and locally accessible within the network.I can execute api calls like this: <code>http://mylocalapi:133/api/Values/Get</code> and I get a result.</p>
  
  <p>I have an external site which is <code>http://example.org</code> and I would like to execute the same <code>http://mylocalapi:133/api/Values/Get</code>.</p>
  
  <p>Both the external facing site as well as the internal API site is hosted on the same server (but it can be different, for example a 3rd party vendor outside of the network)</p>
  
  <p>I have CORS set up in my API like this:</p>
  
  <p><code>[EnableCors(origins: "http://example.org", headers: "*", methods: "*")]</code></p>
  
  <p>But I keep getting the following error:</p>
  
  <p><code>XMLHttpRequest cannot load http://mylocalapi:133. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://example.org' is therefore not allowed access.</code></p>
  
  <p>So get around it, I created a virtual directory (<code>APICALLS</code>) in my external site and created a web.config file which will point to the local IIS site:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
      &lt;system.webServer&gt;
          &lt;httpRedirect enabled="true" destination="http://mylocalapi:133" exactDestination="true" /&gt;
      &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>When I do that, I try to access the API like this: <code>http://example.org/APICALLS/api/Values/Get</code> but I get the following error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://mylocalapi:133. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://example.org' is therefore not allowed access.
  </code></pre>
  
  <p>What am I doing wrong and how can I resolve the issue.</p>