title: Enabling CORS with WebAPI PUT / POST requests?
body: <p>I've tried following this post but I'm still not quite there:</p>
  
  <p><a href="https://stackoverflow.com/questions/12521499/cors-support-for-put-and-delete-with-asp-net-web-api">CORS support for PUT and DELETE with ASP.NET Web API</a></p>
  
  <p>In my web.config I have the following: </p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;!-- TODO: don't let anyone make requests - only approved clients --&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
          &lt;add name="Access-Control-Allow-Headers" value="Content-Type" /&gt;
          &lt;add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" /&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
      &lt;handlers&gt;
        &lt;remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /&gt;
        &lt;remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /&gt;
        &lt;remove name="ExtensionlessUrlHandler-Integrated-4.0" /&gt;
        &lt;remove name="WebDAV" /&gt;
        &lt;add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /&gt;
        &lt;add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /&gt;
        &lt;add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /&gt;
      &lt;/handlers&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"&gt;
        &lt;remove name="WebDAVModule"/&gt;
      &lt;/modules&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>But in chrome when I make a POST request I get the Not Allowed error: </p>
  
  <p><img src="https://i.stack.imgur.com/lrLih.png" alt="enter image description here"></p>
  
  <p>My request looks like this: </p>
  
  <pre class="lang-js prettyprint-override"><code>var request = $.ajax({
              async: true,
              url: apiEndpoint + 'api/login',
              type: 'POST',
              data: JSON.stringify(data),
              contentType: "application/json; charset=utf-8",
              dataType: 'json'
          })
  </code></pre>
  
  <p>apiEndpoint is on localhost but on a different port - the client and api projects are in different solutions.  </p>
  
  <p>The POST request eventually makes its way to the server, but I always get an error related to OPTIONS and I never get a cookie saved to the client because of it.  </p>
  
  <p>I spent the last couple hours trying to get CORS with WebAPI working: </p>
  
  <p><a href="https://aspnetwebstack.codeplex.com/wikipage?title=CORS%20support%20for%20ASP.NET%20Web%20API" rel="nofollow noreferrer">https://aspnetwebstack.codeplex.com/wikipage?title=CORS%20support%20for%20ASP.NET%20Web%20API</a></p>
  
  <p>But some assembly versioning issues led to me yanking everything out - hopefully there's a simpler solution.  </p>