title: ASP.NET 5: Access-Control-Allow-Origin in response
body: <p>From what I understand, when enabled CORS accordingly, the response model should include the following header information (provided that I want to allow everything):</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Allow-Method: *
  Access-Control-Allow-Header: *
  </code></pre>
  
  <p>Enabling it in <code>Startup</code>:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      //...
      services.AddCors();
      services.ConfigureCors(options =&gt; 
      {
          options.AddPolicy("AllowAll", p =&gt; p.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().AllowCredentials());
      });
      //...
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      //...
      app.UseCors("AllowAll");
      //...
  }
  </code></pre>
  
  <p>The problem is that none of these headers are returned and I get the following error when trying to request from the API:</p>
  
  <blockquote>
    <p>Response to preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost">http://localhost</a>' is therefore not allowed access.</p>
  </blockquote>