title: Preflight request is ok, then, after auth, response does not contain allow cors header
body: <p>Asp MVC 5 app deployed on IIS 8.5.
  Need to enable ajax request from a number of clients.</p>
  
  <p>Server-side I have In WebApiConfig.cs</p>
  
  <pre><code>config.EnableCors();
  </code></pre>
  
  <p>In controller:</p>
  
  <pre><code>[EnableCors(origins: "http://localhost:59901", headers: "*", methods: "*", SupportsCredentials = true)]
  public class ItemController : Controller
  </code></pre>
  
  <p>Client side</p>
  
  <pre><code>$("#getItem").on("click", function (e) {
      var myurl = "http://servername/item/details/1"
  
      $.ajax({
          url: myurl,
          type: "GET",
          dataType: "JSON",
          xhrFields: {
              withCredentials: true
          },
          contentType: "application/json; charset=utf-8",
          error: function (jqXHR, textStatus, errorThrown) {
              $('#result').text(jqXHR.responseText || textStatus);
          },
          success: function (result) {
              $('#result').text(result);
          }
      });
  });
  </code></pre>
  
  <p>Running client from VisualStudio Origin is <a href="http://localhost:59901" rel="nofollow noreferrer">http://localhost:59901</a>.</p>
  
  <p>Running the ajax request I get the following in fiddler:</p>
  
  <p><strong>1. Preflight request/response</strong></p>
  
  <pre><code>OPTIONS http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
  Host: vrtsrv01.webdev.local
  Connection: keep-alive
  Access-Control-Request-Method: GET
  Origin: http://localhost:59901
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
  Access-Control-Request-Headers: content-type
  Accept: */*
  Referer: http://localhost:59901/Home/Index
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4
  
  HTTP/1.1 200 OK
  Server: Microsoft-IIS/8.5
  Access-Control-Allow-Origin: http://localhost:59901
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, MaxDataServiceVersion
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Credentials: true
  X-Powered-By: ASP.NET
  Date: Sat, 13 May 2017 15:34:54 GMT
  Content-Length: 0
  </code></pre>
  
  <p><strong>2. GET request without credentials/ 401 error response</strong></p>
  
  <pre><code>GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
  Host: vrtsrv01.webdev.local
  Connection: keep-alive
  Accept: application/json, text/javascript, */*; q=0.01
  Origin: http://localhost:59901
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
  Content-Type: application/json; charset=utf-8
  Referer: http://localhost:59901/Home/Index
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4
  
  HTTP/1.1 401 Unauthorized
  Cache-Control: private
  Content-Type: text/html
  Server: Microsoft-IIS/8.5
  X-AspNet-Version: 4.0.30319
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  X-Powered-By: ASP.NET
  Date: Sat, 13 May 2017 15:34:54 GMT
  Content-Length: 1352
  Proxy-Support: Session-Based-Authentication
  
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/&gt;
  &lt;title&gt;401 - Autorizzazione negata: accesso negato a causa di credenziali non valide.&lt;/title&gt;
  ....
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div id="header"&gt;&lt;h1&gt;Errore del server&lt;/h1&gt;&lt;/div&gt;
  ....
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>3. GET request with NTLM token for auth / response without Allow CORS header</strong></p>
  
  <pre><code>GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
  Host: vrtsrv01.webdev.local
  Connection: keep-alive
  Authorization: Negotiate &lt;...NTLM TOKEN HERE ...&gt;
  Accept: application/json, text/javascript, */*; q=0.01
  Origin: http://localhost:59901
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
  Content-Type: application/json; charset=utf-8
  Referer: http://localhost:59901/Home/Index
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4
  
  
  HTTP/1.1 200 OK
  Cache-Control: private
  Content-Type: application/json; charset=utf-8
  Server: Microsoft-IIS/8.5
  X-AspNetMvc-Version: 5.2
  X-AspNet-Version: 4.0.30319
  Persistent-Auth: true
  X-Powered-By: ASP.NET
  Date: Sat, 13 May 2017 15:34:58 GMT
  Content-Length: 8557
  
  {"id":1, .....}
  </code></pre>
  
  <p><strong>QUESTION</strong></p>
  
  <p>Why after enabling MVC app for CORS and seeing the right response to preflight request, the response obtained after NTLM authentication does not contain the expected Access-Control-Allow-Origin header? </p>