title: Asp.Net WebApi2 Enable CORS not working with AspNet.WebApi.Cors 5.2.3
body: <p>I tried to follow the steps at <a href="http://enable-cors.org/server_aspnet.html">http://enable-cors.org/server_aspnet.html</a>
  to have my RESTful API (implemented with ASP.NET WebAPI2) work with cross origin requests (CORS Enabled). It's not working unless I modify the web.config.</p>
  
  <p>I installed WebApi Cors dependency:</p>
  
  <pre><code>install-package Microsoft.AspNet.WebApi.Cors -ProjectName MyProject.Web.Api
  </code></pre>
  
  <p>Then in my <code>App_Start</code> I've got the class <code>WebApiConfig</code> as follows:</p>
  
  <pre><code>public static class WebApiConfig
  {
      public static void Register(HttpConfiguration config)
      {
          var corsAttr = new EnableCorsAttribute("*", "*", "*");
          config.EnableCors(corsAttr);
  
          var constraintsResolver = new DefaultInlineConstraintResolver();
  
          constraintsResolver.ConstraintMap.Add("apiVersionConstraint", typeof(ApiVersionConstraint));
          config.MapHttpAttributeRoutes(constraintsResolver); 
          config.Services.Replace(typeof(IHttpControllerSelector), new NamespaceHttpControllerSelector(config));
          //config.EnableSystemDiagnosticsTracing(); 
          config.Services.Replace(typeof(ITraceWriter), new SimpleTraceWriter(WebContainerManager.Get&lt;ILogManager&gt;())); 
          config.Services.Add(typeof(IExceptionLogger), new SimpleExceptionLogger(WebContainerManager.Get&lt;ILogManager&gt;()));
          config.Services.Replace(typeof(IExceptionHandler), new GlobalExceptionHandler()); 
      }
  }
  </code></pre>
  
  <p>but after that I run the application, I request a resource with Fiddler like:
  <a href="http://localhost:51589/api/v1/persons">http://localhost:51589/api/v1/persons</a>
  and in the response I cannot see the HTTP headers that I should see such as:</p>
  
  <ul>
  <li><code>Access-Control-Allow-Methods: POST, PUT, DELETE, GET, OPTIONS</code></li>
  <li><code>Access-Control-Allow-Origin: *</code></li>
  </ul>
  
  <p>Am I missing some step? I have tried with the following annotation on the controller:</p>
  
  <p><code>[EnableCors(origins: "http://example.com", headers: "*", methods: "*")]</code></p>
  
  <p>Same result, no CORS enabled.</p>
  
  <p>However, if I add the following in my web.config (without even installing the AspNet.WebApi.Cors dependency) it works:</p>
  
  <pre><code>&lt;system.webServer&gt;
  
  &lt;httpProtocol&gt;
    &lt;!-- THESE HEADERS ARE IMPORTANT TO WORK WITH CORS --&gt;
    &lt;!--
    &lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
      &lt;add name="Access-Control-Allow-Methods" value="POST, PUT, DELETE, GET, OPTIONS" /&gt;
      &lt;add name="Access-Control-Allow-Headers" value="content-Type, accept, origin, X-Requested-With, Authorization, name" /&gt;
      &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
    &lt;/customHeaders&gt;
    --&gt;
  &lt;/httpProtocol&gt;
  &lt;handlers&gt;
    &lt;!-- THESE HANDLERS ARE IMPORTANT FOR WEB API TO WORK WITH  GET,HEAD,POST,PUT,DELETE and CORS--&gt;
    &lt;!--
  
    &lt;remove name="WebDAV" /&gt;
    &lt;add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /&gt;
    &lt;remove name="ExtensionlessUrlHandler-Integrated-4.0" /&gt;
    &lt;remove name="OPTIONSVerbHandler" /&gt;
    &lt;remove name="TRACEVerbHandler" /&gt;
    &lt;add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /&gt;
  --&gt;
  &lt;/handlers&gt;
  </code></pre>
  
  <p></p>
  
  <p>Any help would be much appreciated!</p>
  
  <p>Thank you.</p>