title: Browser OPTIONS request method and windows authorization
body: <p>I'm trying to POST data from my Angular 2 service to ASP.NET 5 API that uses windows authentication and is hosted on IIS.
  After some modification to angular, requests are created with:</p>
  
  <pre><code>var request = new XMLHttpRequest();
  request.withCredentials = true;
  </code></pre>
  
  <p>That's solved my problem with authorizing GET requests, now for a first GET request, server returns 401 response with headers:</p>
  
  <pre><code>WWW-Authenticate:Negotiate
  WWW-Authenticate:NTLM
  </code></pre>
  
  <p>And after that angular client sends an another request, but this time with a Authorization header that contains NTLM token and it works.</p>
  
  <p>For POST request I added "Content-Type: application/json" to request's header, so browser sends a first request like this:</p>
  
  <pre><code>OPTIONS /api/reservation/ HTTP/1.1
  Host: localhost:82
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  Access-Control-Request-Method: POST
  Origin: http://localhost:81
  User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
  Access-Control-Request-Headers: content-type
  Accept: */*
  Referer: http://localhost:81/
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: pl-PL,pl;q=0.8,en-US;q=0.6,en;q=0.4
  </code></pre>
  
  <p>And server responds with:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Server: Microsoft-IIS/8.5
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  X-Powered-By: ASP.NET
  Date: Wed, 13 Jan 2016 11:54:56 GMT
  Content-Length: 6394
  </code></pre>
  
  <p>But this time, instead of another request with authorization, like in GET request, there's an error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://localhost:82/api/reservation/. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:81' is therefore not allowed access. The response had HTTP status code 401.
  </code></pre>
  
  <p>For CORS I use this configuration in ASP.NET 5:</p>
  
  <pre><code>services.AddCors(options =&gt; options.AddPolicy("AllowAll", p =&gt; p.AllowAnyOrigin().AllowAnyMethod().WithHeaders("accept", "authorization", "content-type", "origin", "x-custom-header").AllowCredentials()));
  </code></pre>
  
  <p>Can I somehow disable windows authentication for OPTIONS requests in IIS?
  Or maybe there's some way to force browser to follow up with authorization?</p>