title: WCF Self-Hosted Data Services with CORS and Basic Auth support
body: <p>I'm building a WCF Self-Hosted Data Service (OData, by the way) and I'm using Basic Authentication to authenticate users. It wasn't very hard, I just needed some configuration steps, build a UserNamePasswordValidator and a IAuthorizationPolicy - DONE.</p>
  
  <p>Now I need to support CORS (<a href="https://en.wikipedia.org/wiki/Cross-origin_resource_sharing" rel="nofollow">Cross-Origin Resource Sharing</a>). I've tried many implementations, some documented (for instance, <a href="http://enable-cors.org/index.html" rel="nofollow">this</a>), other made by myself.</p>
  
  <p><strong>The problem is</strong>, if I let Basic Auth enabled, because the CORS preflight request (OPTIONS) doesn't have the 'Authorization' header, and I can't manipulate the request (of course, or that would defeat the purpose for the browser to do it), I'm unable to intercept/respond the request on the server. I can't even check how far does it go! I've tried to implement many Behaviours, Bindings, Managers, etc., but I can't catch that request, not even on "DataService&lt;>.OnStartProcessingRequest()".</p>
  
  <p><strong>If I disable Basic Auth</strong> on the server side, I'm able to catch the CORS preflight request and eventually respond to it (using a IDispatchMessageInspector and a BehaviorExtensionElement), but that way I have to implement Basic Auth on my own... damn.</p>
  
  <p>Please help me.
  How do I implement both? How can I intercept the CORS preflight request before Basic Auth simply respond 401 Unauthorized?</p>
  
  <p>Thanks in advance.</p>