title: enabling cross-origin resource sharing on IIS7
body: <p>I recently ran into with posting Javascript requests to another domain.  By default XHR  posting to other domains is not allowed.</p>
  
  <p>Following the instructions from <a href="http://enable-cors.org/" rel="noreferrer">http://enable-cors.org/</a>, I enabled this on the other domain.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
   &lt;system.webServer&gt;
    &lt;httpProtocol&gt;
      &lt;customHeaders&gt;
        &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
        &lt;add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" /&gt;
        &lt;add name="Access-Control-Allow-Headers" value="Content-Type" /&gt;
      &lt;/customHeaders&gt;
    &lt;/httpProtocol&gt;
   &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p><img src="https://i.stack.imgur.com/xmx7u.png" alt="enter image description here"></p>
  
  <p>Everything works fine now, however it is still return a 405 response before sending back the working 200 response.</p>
  
  <pre><code>Request URL:http://testapi.nottherealsite.com/api/Reporting/RunReport
  Request Method:OPTIONS
  Status Code:405 Method Not Allowed
  Request Headersview source
  Accept:*/*
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-GB,en-US;q=0.8,en;q=0.6
  Access-Control-Request-Headers:origin, content-type, accept
  Access-Control-Request-Method:POST
  Connection:keep-alive
  Host:testapi.nottherealsite.com
  Origin:http://test.nottherealsite.com
  Referer:http://test.nottherealsite.com/Reporting
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
  Response Headersview source
  Access-Control-Allow-Headers:Content-Type
  Access-Control-Allow-Methods:GET,PUT,POST,DELETE,OPTIONS
  Access-Control-Allow-Origin:*
  Allow:POST
  Cache-Control:private
  Content-Length:1565
  Content-Type:text/html; charset=utf-8
  Date:Tue, 18 Sep 2012 14:26:06 GMT
  Server:Microsoft-IIS/7.5
  X-AspNet-Version:4.0.30319
  X-Powered-By:ASP.NET
  </code></pre>
  
  <p>Update: 3/02/2014</p>
  
  <p>There is a recently updated article in MSDN magazine. Detailing CORS Support in ASP.NET Web API 2.</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/magazine/dn532203.aspx" rel="noreferrer">http://msdn.microsoft.com/en-us/magazine/dn532203.aspx</a></p>