title: Issues with CORS in ASP.NET
body: <p>I have this App where I would like to set my custom headers in the Web.Config, alas this is not always fool proof.</p>
  
  <pre><code>  &lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
      &lt;add name="Access-Control-Allow-Methods" value="*" /&gt;
      &lt;add name="Access-Control-Allow-Headers" value="*" /&gt;
    &lt;/customHeaders&gt;
  </code></pre>
  
  <p>The above set and iterations of it such as </p>
  
  <pre><code>  &lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
      &lt;add name="Access-Control-Allow-Methods" value="OPTIONS,GET,PUT,DELETE,POST" /&gt;
      &lt;add name="Access-Control-Allow-Headers" value="Authorization,Content-Type" /&gt;
    &lt;/customHeaders&gt;
  </code></pre>
  
  <p>has not worked worked for me in all scenario's. As of now this setting works in about 50% of the test machines and gives <code>405 Method Not Allowed</code> in others.</p>
  
  <p>The alternative is set this in <code>WebApiConfig.cs</code> and uncomment the custom headers in <code>Web.config</code>.</p>
  
  <pre><code>//Web API Cross origin requests - Enable
    var cors = new EnableCorsAttribute("*", "*", "*");
    config.EnableCors(cors);
  </code></pre>
  
  <p>Why is there so much ambiguity in this and how do I know for sure where <code>CORS</code> will work all the time? I am really interested in setting CORS on <code>Web.config</code> only as I would like the flexibility of modifying it in the deployed version.</p>