title: CORS 405 Method Not Allowed
body: <p>I have been following the <a href="https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS">Mozilla article</a> on how to set up my website to allow <strong>Cross-site scripting requests</strong>. Using IIS Manager I have added the following HTTP Response Headers</p>
  
  <pre><code>Access-Control-Allow-Origin  : *
  Access-Control-Allow-Headers : Origin, SecurityPrivateKeyID
  Access-Control-Allow-Methods : GET, POST, PUT, DELETE, OPTIONS
  </code></pre>
  
  <p>Despite this I keep getting a <code>405 Method Not Allowed</code> when my browsers (Firefox and Chrome) send the pre-flight request with a custom <code>SecurityPrivateKeyID</code> header.</p>
  
  <p>Request</p>
  
  <pre><code>OPTIONS /Service/Json/User.svc/ HTTP/1.1
  Host: serviceprovider.com
  User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Origin: http://client.com
  Access-Control-Request-Method: GET
  Access-Control-Request-Headers: securityprivatekeyid
  Connection: keep-alive
  </code></pre>
  
  <p>Response</p>
  
  <pre><code>HTTP/1.1 405 Method Not Allowed
  Allow: GET
  Content-Length: 1565
  Content-Type: text/html; charset=UTF-8
  Server: Microsoft-IIS/8.0
  access-control-allow-origin: *
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Headers: Origin, SecurityPrivateKeyID
  Date: Sat, 23 Mar 2013 08:35:03 GMT
  </code></pre>
  
  <p>The service works fine when accessing directly at <code>http://serviceprovider.com/Service/Json/User.svc/</code>.</p>
  
  <p>Any ideas on what I am doing wrong?</p>
  
  <p>[note I have changed my hosts files to point client.com and serviceprovider.com at my machine]</p>
  
  <p>[a solution using JSONP will not do as my web service must be able to consume POST, PUT and DELETE methos]</p>