title: CORS headers missing when deployed on Azure Web App / Azure API
body: <p>I have created an OWIN hosted <code>WebAPI 2</code>. There's also a web app (<code>AngularJS</code>) that's using the API and acting as a client.</p>
  
  <p>I've added the necessary code for the <code>CORS</code> to the <code>Startup.cs</code>, and hosted it in local IIS on a port different than the client and confirmed that it fixes the <code>Cors</code> issue.</p>
  
  <p>Then, I deployed both apps to Azure (I've put both on the Azure as Web App, and I also tried putting the OWIN to the Azure API that is currently in preview) but - the preflight request now fails (no <code>Access-Control-Allow-Origin</code> present in the response).</p>
  
  <p><strong>Q:</strong> Is there some specific of Azure I'm not aware of? How come that OWIN isn't serving this header when deployed but it's working on localhost? I don't see any constraints in the properties window on Azure blades settings for the apps.</p>
  
  <p>Notes:</p>
  
  <p>About some specifics of the setup I'm using:</p>
  
  <ul>
  <li>Using <code>Owin</code>, <code>WebAPI2</code>, <code>Ninject</code>, <code>SignalR</code></li>
  <li>Custom token is issued and provided in headers on each subsequent request, and is verified with a custom filter.</li>
  <li>Cors I'm attempting for now is <code>*</code></li>
  </ul>
  
  <p>The relevant part of Startup.cs:</p>
  
  <pre><code>public void Configuration(IAppBuilder appBuilder)
  {
      appBuilder.UseCors(CorsOptions.AllowAll);
  
      HttpConfiguration config = new HttpConfiguration();
      config.Formatters.JsonFormatter.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
  
      //bind IClientsNotifier with method returning singleton instance of hub
      var ninjectKernel = NinjectWebCommon.GetKernel();
      ninjectKernel.Bind&lt;MySignalRHub&gt;().ToSelf().InSingletonScope();
      ninjectKernel.Bind&lt;QueryStringBearerAuthorizeAttribute&gt;().ToSelf();
  
      GlobalHost.DependencyResolver = new NinjectSignalRDependencyResolver(ninjectKernel);
      appBuilder.Map(
          "/signalr", map =&gt;
      {
          map.UseCors(CorsOptions.AllowAll);
          var hubConfiguration = new HubConfiguration();
          map.RunSignalR(hubConfiguration);
      });
  
      config.MapHttpAttributeRoutes();
  
      config.Routes.MapHttpRoute(
         name: "DefaultApi",
         routeTemplate: "api/{controller}/{id}",
         defaults: new { id = RouteParameter.Optional }
      );
  
      config.Formatters.Remove(config.Formatters.XmlFormatter);
  
      config.Filters.Add(new NoCacheHeaderFilter()); //the IE9 fix for cache
      var resolver = new NinjectDependencyResolver(NinjectWebCommon.GetKernel());
  
  config.Filters.Add((System.Web.Http.Filters.IFilter)resolver.GetService(typeof(WebApiAuthenticationFilter)));
  
      appBuilder.UseNinjectMiddleware(NinjectWebCommon.GetKernel);
      appBuilder.UseNinjectWebApi(config);
  }
  </code></pre>
  
  <p>Additionally, I've commented out the following line from the <code>web.config</code> in order to support the <code>OPTIONS</code> HTTP request (otherwise, it was throwing HTTP error 405)</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
     &lt;handlers&gt;
       &lt;!--&lt;remove name="OPTIONSVerbHandler" /&gt;--&gt;
       ...
  </code></pre>