title: Enable Access-Control-Allow-Credentials header in Azure website (Azure App Services)
body: <p>We recently migrated an API application from Azure Cloud Services to Azure Websites, and some clients are still using our legacy protocol for authentication, which uses cookies (instead of the usual <code>Authorization: Bearer</code> HTTP header). We need to support this authentication protocol for a little longer as the clients will not be able to migrate right away.</p>
  
  <p>To support cookies in a cross-origin ajax request directed to the API, the client needs to set the <code>withCredentials</code> setting to <code>true</code> in the XMLHttpRequest, and the server needs to repond with the <code>Access-Control-Allow-Credentials</code> header as well to any CORS request.</p>
  
  <p>The problem we face is that the Azure Website manages CORS all by itself, and uses its own configuration (which is limited to a list of allowed origins) for the response, which does not allow this header to be set... thus breaking the application for all our Ajax clients!</p>
  
  <p>Is there a way to (temporarily) add this header in the responses?</p>