title: Response to preflight request doesn't pass access control check No 'Access-Control-Allow-Origin' header is present on the requested resource
body: <p>I have .NET Core WebAPI being hosted on IIS that I have enabled CORS in the startup.cs.</p>
  
  <p>When making a request to the API from my Angular app, the request fails and i get this error </p>
  
  <blockquote>
    <p>"Access to XMLHttpRequest at '<a href="https://test-api.contractorconnection.com/ERCore_Service/api/LandingPage/Authenticate/Austin.Born/ERCore" rel="nofollow noreferrer">https://test-api.contractorconnection.com/ERCore_Service/api/LandingPage/Authenticate/Austin.Born/ERCore</a>' from origin '<a href="https://test-apps2.contractorconnection.com" rel="nofollow noreferrer">https://test-apps2.contractorconnection.com</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.".</p>
  </blockquote>
  
  <p>When making the request directly from the browser or postman, the request completes and I get my data.</p>
  
  <p>I have tried many answers, modifying the <em>web.config</em>, and specifying the allowed origins in the <em>Startup.cs</em></p>
  
  <p>What am I missing here or doing incorrectly?</p>
  
  <p>Startup.cs below</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services) {
      //  //For JWT Auth
      services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddJwtBearer(options =&gt; {
          options.TokenValidationParameters = new TokenValidationParameters {
              ValidateIssuer = true,
              ValidateAudience = true,
              ValidateLifetime = true,
              ValidateIssuerSigningKey = true,
              ValidIssuer = Configuration["Jwt:Issuer"],
              ValidAudience = Configuration["Jwt:Issuer"],
              IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
          };
      });
      services.AddScoped&lt;ILandingPage, DAL_LandingPage&gt;();
      services.AddScoped&lt;IDetails, DAL_EstimateDetailPage&gt;();
      services.AddScoped&lt;IQueueDetailsPage, DAL_QueueDetails&gt;();
      services.AddScoped&lt;IAdminDetailPage, DAL_AdminDetailPage&gt;();
      services.AddScoped&lt;IAdminCatSelTab, DAL_AdminCatSel&gt;();
      services.AddScoped&lt;IApplicationSecurityTab, DAL_ApplicationSecurityTab&gt;();
  
      //services.AddCors();
      services.AddCors(o =&gt; o.AddPolicy("MyPolicy", builder =&gt; {
          builder.AllowAnyHeader()
              .AllowAnyMethod()
              .WithOrigins("https://test-apps2.contractorconnection.com", "https://test-apps2.contractorconnection.com/ERCore", "http://localhost:54807/")
              .AllowCredentials();
      }));
  
      services.AddMvc().AddJsonOptions(options =&gt; {
          options.SerializerSettings.ContractResolver
              = new Newtonsoft.Json.Serialization.DefaultContractResolver();
      });
      services.AddDbContext&lt;PrismDataContext1&gt;(options =&gt; options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
      services.Configure&lt;AppSettings&gt;(Configuration.GetSection("AppSettings"));
  
  
  
  }
  
  // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
  public void Configure(IApplicationBuilder app, IHostingEnvironment env) {
      if (env.IsDevelopment()) {
          app.UseDeveloperExceptionPage();
      }
      //app.UseCors(builder =&gt; builder.WithOrigins("http://localhost:4200", "https://cc-er-dev-api.primussoft.com", "https://test-apps2.contractorconnection.com", "https://apps2.contractorconnection.com").AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod());
      app.UseCors("MyPolicy");
      app.UseOptions();
      //For JWT Auth
      app.UseAuthentication();
      app.UseMvc();
  }
  </code></pre>
  
  <p>Controller endpoint</p>
  
  <pre class="lang-cs prettyprint-override"><code>[HttpGet]
  [Route("api/LandingPage/Authenticate/{webLogin}/{appName}")]
  [HttpOptions]
  public JsonResult AuthenticateUser(string webLogin, string appName) {
      string connectionString = _config.GetSection("ConnectionStrings").GetSection("DefaultConnection").Value;
      Auth auth = new Auth(connectionString);
      User obj = new User();
      try {
          bool hasAccess = auth.Load(webLogin, appName);
          obj.Name = auth.Name;
          obj.ResourceTypeName = auth.ResourceTypeName;
          obj.ClassificationName = auth.ClassificationName;
          obj.Login = auth.Login;
          obj.ResourceID = auth.ResourceID;
          obj.DetailID = auth.DetailID;
          obj.ApplicationID = auth.ApplicationID;
          obj.ResourceTypeID = auth.ResourceTypeID;
          obj.ClassificationID = auth.ClassificationID;
          obj.SecurityFeatures = auth.FeatureAccess;
          obj.CurrentLanguageDescription = auth.CurrentLanguageDescription;
          obj.CurrentLanguageID = auth.CurrentLanguageID;
          var tokenString = BuildToken(obj);
          obj.Token = tokenString;
  
          Response.Headers.Add("Access-Control-Allow-Origin", "https://test-apps2.contractorconnection.com");
  
          return Json(obj);
      } catch (Exception ex) {
          string ac = ex.Message;
          return Json(obj);
      }
  }
  </code></pre>
  
  <p>Web.config</p>
  
  <pre class="lang-js prettyprint-override"><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
    &lt;system.webServer&gt;
      &lt;cors enabled="true" failUnlistedOrigins="false"&gt;
          &lt;add origin="*" allowed="true" /&gt;
      &lt;/cors&gt;
      &lt;handlers&gt;
        &lt;add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" /&gt;
      &lt;/handlers&gt;
      &lt;aspNetCore processPath=".\ERCore_Service.exe" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" /&gt;
      &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*"/&gt;
          &lt;add name="Access-Control-Allow-Headers" value="Content-Type"/&gt;
          &lt;add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS"/&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
    &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>