title: CORS preflighting to WebAPI2 not returning correct headers
body: <p>I've been fighting a CORS issue for a few days now and I'm stuck.   I've got an angular app trying to do a simple HTTP Post of Json data.</p>
  
  <p>I've gone down the route described here: <a href="https://msdn.microsoft.com/en-us/magazine/dn532203.aspx" rel="nofollow" title="ASP.NET Web API - CORS Support in ASP.NET Web API 2">ASP.NET Web API - CORS Support in ASP.NET Web API 2</a> With a custom factory, and I've set my web.config up as: </p>
  
  <pre><code>    &lt;handlers&gt;
        &lt;remove name="WebDAV"/&gt;
        &lt;remove name="OPTIONSVerbHandler"/&gt;
        &lt;remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /&gt;
        &lt;remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /&gt;
        &lt;remove name="ExtensionlessUrlHandler-Integrated-4.0" /&gt;
        &lt;add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /&gt;
        &lt;add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /&gt;
        &lt;add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /&gt;
    &lt;/handlers&gt;
  </code></pre>
  
  <p>My $http post call:</p>
  
  <pre><code>            var serviceEndpoint = "https://mybox/ourservices/myservices/1.0.0.1/api/process";
  
          var requestData ={'FirstName':'Nick','LastName':'Jacobs'};
  
          $http({
              method: "POST",
              url: serviceEndpoint,
              withCredentials: true,
              data: requestData,
              headers: {
                  'Content-Type': 'application/json',
                  'Accept':'application/json'
              }
          })
          .success(function (data, status, headers, config) {
              // I need to pick off the user name from the JSON that's returned.
              console.log(data);
              deferred.resolve(data);
          })
          .error(function (data, status) {
              deferred.reject(data);
          });
  </code></pre>
  
  <p>The thing is, I see the pre-flight request to the server, it's passing my origin, and asking for appropriate headers, but I get none of the CORS response headers back.   If I go into the web.config and add in the allowed-methods, I do see that come back, but since I'm using withCredentials then I can't use a wild card origins response header, and I was hoping the factory described in the MSDN document above would have solved my problem.</p>
  
  <p>Any ideas what I'm missing?</p>
  
  <p>Thanks eveyrbody!</p>