title: IIS hijacks CORS Preflight OPTIONS request
body: <p>I am making a CORS POST request and setting the Content-Type header to json. This triggers a Preflight OPTIONS request to fire (this is good and expected)</p>
  
  <p>This OPTIONS request is responded to with a 200 OK but this isn't coming from my WebAPI application. </p>
  
  <p>I have a custom Message Handler in place and it never get's hit so the request is getting responded to by IIS prior to hitting ASP.NET it seems.</p>
  
  <p>I have found several posts on the subject and they say the following</p>
  
  <ol>
  <li><p>Make sure WebDav is uninstalled / removed / disabled - <strong>DONE</strong></p></li>
  <li><p>Make sure the OPTIONSVerbHandler is removed / changed to use aspnet_isapi.dll - <strong>TRIED BOTH</strong></p></li>
  <li><p>Make sure the extensionlessURLHandler includes the OPTIONS verb - <strong>DONE</strong></p></li>
  </ol>
  
  <p>However, my options request is still getting hijacked. By that I mean, IIS responds with at 200 OK but isn't including an Access-Control-Allow-Origin header in the response. It isn't including this header because it is never getting to my WebAPI CORS code that would set this header.</p>
  
  <p>The two best posts I could find that sound like my issue are </p>
  
  <p>here: <a href="https://stackoverflow.com/questions/14897247/jquery-stuck-at-cors-preflight-and-iis-ghost-response">JQuery stuck at CORS preflight and IIS ghost response</a></p>
  
  <p>and here: <a href="http://brockallen.com/2012/10/18/cors-iis-and-webdav/" rel="noreferrer">http://brockallen.com/2012/10/18/cors-iis-and-webdav/</a></p>
  
  <p>I have tried turning on Failed Request tracing (FERB) in IIS and set it to trace all 200 status codes. I don't ever see the options request being logged... Not sure if this means FERB doesn't track OPTIONS requests or if I need to change something in the FERB settings to make it track OPTIONS requests, Or if this is a clue to what my problem is? </p>
  
  <p>This is ASP.NET WebAPI 2.0 running on IIS 7.5 (Also tested on IIS 8 and IISExpress with same results)
  Doesn't matter what browser (Chrome, FF, and IE all fail the same way) </p>
  
  <p>I have tried everything I can find on the subject and still can't fix my problem.</p>
  
  <p>Help me StackOverflow, you're my only hope.</p>