Using: Angular 7, .net core, web api

I recently changed my application to use windows authentication and now my once working requests are failing for any post and put (get works). I am getting a 

```
Access to XMLHttpRequest at 'https://localhost:44372/api/tasks' from 
origin 'http://localhost:4200' has been blocked by CORS policy: Response 
to preflight request doesn't pass access control check: No 'Access- 
Control-Allow-Origin' header is present on the requested resource.

```

I had to add an angular interceptor to get the get requests to work with windows authentication enabled.

```
@Injectable()
export class CredentialsInterceptor implements HttpInterceptor {

intercept(request: HttpRequest<any>, next: HttpHandler): 
Observable<HttpEvent<any>> {
    request = request.clone({
        withCredentials: true
    });
    return next.handle(request);
  }
}

```

My startup.cs is adding CORS like this (I have to setIsOriginAllowed for the get requests to work)

```
services.AddCors(o => o.AddPolicy("AllowAll", builder =>
        {
            builder.SetIsOriginAllowed((host) => true)
                   .AllowAnyMethod()
                   .AllowAnyHeader()
                   .AllowCredentials();
        }));

...//Configure
app.UseCors("AllowAll");
app.UseMvc(routes =>
{
    ...

```

I've also tried specifying the origins or methods
 .WithOrigins("<https://localhost:4200>", "<http://localhost:4200>")
or
 .AllowAnyOrigin()

As well as adding the header manually while in the interceptor

```
intercept(request: HttpRequest<any>, next: HttpHandler): 
Observable<HttpEvent<any>> {
    request = request.clone({
        withCredentials: true
    });
    request.headers.append('Access-Control-Allow-Origin', 'http://localhost:4200');
    return next.handle(request);

```

What am I missing? I've been googling for hours. I understand that CORS is blocked if the allowed origin isn't specified. Other StackOverflows are saying that it can't be the client side but I feel that the client request is not sending the 'Access-Control-Allow-Origin' header. How can I test to make sure that header is set? Why would Get work and not Put requests?