title: Response to preflight request doesn't pass access control check: It does not have HTTP ok status when using Authentication in Header
body: <p>I have deployed a .Net Core Applicaition in an ISS Server. In client site I have a React Application using axios to communicate with the server.</p>
  
  <p>On server this is how I modified the web config</p>
  
  <pre><code>&lt;httpProtocol&gt;
              &lt;customHeaders&gt;
                  &lt;remove name="Access-Control-Allow-Origin" /&gt;
                  &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
                  &lt;add name="Access-Control-Allow-Origin" value="http://localhost:3000" /&gt;
                  &lt;add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" /&gt;
                  &lt;add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Access-Control-Allow-Headers, Content-Type, Authorization" /&gt;
                  &lt;add name="Access-Control-Max-Age" value="86400" /&gt;
              &lt;/customHeaders&gt;
          &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>On the client </p>
  
  <pre><code>const getRequestConfig = async (): Promise&lt;AxiosRequestConfig&gt; =&gt; {
    let accessToken = await OAuth2Service.getInstance().GetAccessToken();
    return {
      headers: {
        Authorization: `Bearer ${accessToken}`
      },
      withCredentials: true
    };
  };
  
  let config = await getRequestConfig();
      const response = await axios.get(
        `https://myserver/AppService/api/metadata/office`,
        config
      );
  </code></pre>
  
  <p>I get a preflight CORS error</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at
    '<a href="https://myserver/AppService/api/metadata/office" rel="nofollow noreferrer">https://myserver/AppService/api/metadata/office</a>' from origin
    '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' has been blocked by CORS policy: Response to
    preflight request doesn't pass access control check: It does not have
    HTTP ok status.</p>
  </blockquote>
  
  <p>If I remove the authentication from the request header it will pass CORS since it is a simple request. </p>
  
  <ol>
  <li>Do I miss some configuration on server site or on client site?</li>
  <li>Can it be that only in localhost this problem exists and when the site is deployed will pass CORS? In that case I could disable CORS in my browser.</li>
  </ol>