title: Azure storage CORS returns origin wildcard and fails in browser
body: <p>When enabling CORS on Azure blob storage, almost everything can be set but the "...Allow-Credentials" header, which is always true.</p>
  
  <p>So when using a wildcard for the origin-header, the pre-flight request works fine and converts the wildcard into the actual origin.</p>
  
  <p>But the subsequent <code>GET</code> request does not convert the wildcard and returns the following combination: </p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Allow-Credentials: true
  </code></pre>
  
  <p>which is illegal in Chrome (and probably other browsers, too). The error is </p>
  
  <pre><code>XMLHttpRequest cannot load ...
  A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.
  Origin 'http://localhost' is therefore not allowed access. 
  </code></pre>
  
  <p>In the new WebAPI v2 CORS package wildcards are replaced with the actual origin.
  Also, why would I need credentials such as cookies in a request to the blob storage? Better turn it off.</p>
  
  <p>How could I fix that when I want to use the origin wildcard?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Here's the initialize code I run on App_Start</p>
  
  <pre><code>public static void Initialize()
  {
      // Azure blob storage settings
      var storageAccount = CloudStorageAccount.Parse(ConfigurationManager.ConnectionStrings["AzureStorage"].ConnectionString);
      var client = storageAccount.CreateCloudBlobClient();
      var serviceProperties = client.GetServiceProperties();
      serviceProperties.Cors = new CorsProperties();
  
      serviceProperties.Cors.CorsRules.Add(new CorsRule()
      {
          AllowedHeaders = new List&lt;string&gt;() { "*" },
          AllowedOrigins = new List&lt;string&gt;() { "*" },
          AllowedMethods = CorsHttpMethods.Get,
          ExposedHeaders = new List&lt;string&gt;() { "*" },
          MaxAgeInSeconds = 3600
      });
  
      client.SetServiceProperties(serviceProperties);
  }
  </code></pre>