title: Enabling CORS through Web.config vs WebApiConfig and Controller attributes
body: <p>There seems to be two functionally different ways to enable cross-origin request sharing in Web API 2.  </p>
  
  <p>One is to import <code>System.Web.Http.Cors</code>, <strong>decorate a controller</strong> with the <code>EnableCors</code> attribute and to write <code>config.EnableCors()</code> in the WebApiConfig:</p>
  
  <pre><code>[EnableCors(origins: "http://111.111.111.111", headers: "*", methods: "*")]
  public class GenericController : ApiController
  {
      // etc.
  </code></pre>
  
  <p>The other is to <strong>modify the Web.config</strong>:</p>
  
  <pre><code>&lt;system.webServer&gt;
       &lt;httpProtocol&gt;
           &lt;customHeaders&gt;
              &lt;add name="Access-Control-Allow-Origin" value="http://111.111.111.111" /&gt;
              &lt;add name="Access-Control-Allow-Methods" value="*" /&gt;
              &lt;add name="Access-Control-Allow-Headers" value="*" /&gt;
  </code></pre>
  
  <p>Is there a functional difference between these two different approaches?  Which one is correct - don't these accomplish the same thing?  If both methods are used to enable CORS, will things blow up?</p>