title: Web API 2 - CORS only works over HTTPS (not HTTP)
body: <p>All,</p>
  
  <p>I have a really simple Web API 2 project that I'm working on. For some reason I cannot get CORS to work properly unless I put it in the web.config file. I followed the instructions on the <a href="https://msdn.microsoft.com/en-us/magazine/dn532203.aspx" rel="nofollow noreferrer">MSDN article</a> and this <a href="http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api" rel="nofollow noreferrer">ASP.NET article</a>, but I must be missing something. </p>
  
  <p><strong>Global.asax.cs</strong></p>
  
  <pre><code>protected void Application_Start()
  {
      WebApiConfig.Register(GlobalConfiguration.Configuration);
  }
  </code></pre>
  
  <p><strong>WebApiConfig.cs</strong></p>
  
  <pre><code>public static void Register(HttpConfiguration config)
  {
      config.EnableCors(new EnableCorsAttribute("*","*","*"));
  
      config.MapHttpAttributeRoutes();
  }
  </code></pre>
  
  <p><strong>JavaScript</strong></p>
  
  <pre><code>    $.ajax({
          url: '//myapidomain.com/buildings'
      }).done(function (data) {
          var theList     = $('.buildings'),
              theListHTML = "",
              response    = JSON.parse(data);
  
          $.each(response.Buildings.Data, function () {
              theListHTML += '&lt;li&gt;' + this.Description + '&lt;/li&gt;';
          });
          theList.html(theListHTML);
      });
  </code></pre>
  
  <p>I've looked at just about every single Stack Overflow (such as <a href="https://stackoverflow.com/questions/29024313/asp-net-webapi2-enable-cors-not-working-with-aspnet-webapi-cors-5-2-3">this one</a>) and MSDN  forum post (like <a href="http://forums.asp.net/t/1968657.aspx?Web+API+2+Cors+not+working+" rel="nofollow noreferrer">this one</a>), and from what I can tell, this <em>should</em> be working. The app is hosted on an IIS 8 server running 4.0. </p>
  
  <p><strong>Update</strong></p>
  
  <p>It appears to be something with the request itself (or rather IIS configuration). If I send the request over HTTP, then it fails (no access-control headers get sent back). However, if I request it over HTTPS, everything works fine. </p>
  
  <p><strong>Solution</strong></p>
  
  <p>Our hosting environment was intercepting the non-HTTPS requests and forcing them to HTTPS. When it does this it returns a 304 which jQuery's method doesn't know how to handle. The solution is either to just always make the request over HTTPS (preferred) OR to handle this situation yourself/find an alternative library/plugin that handles this scenario. </p>