title: Safari and CORS: Custom Response Headers disappear
body: <p>I've recreated my error as simply as possible, and it goes like this:</p>
  
  <p>I have a c# Web Api project and I installed the CORS Web Api nuget package.  I then added this to the Register function of the WebApiConfig.cs:</p>
  
  <pre><code>var cors = new EnableCorsAttribute("*", "*", "*");
  config.EnableCors(cors);
  </code></pre>
  
  <p>I then created a really simple "GetToken" api, pasted below:</p>
  
  <pre><code>[Route("~/api/auth/token")]
  public HttpResponseMessage GetToken()
  {
      var result = new
      {
          FirstName = "matt"
      };
      var response = Request.CreateResponse(HttpStatusCode.OK, result);
      HttpContext.Current.Response.Headers.Set("Access-Control-Allow-Headers", "Authorization");
      HttpContext.Current.Response.Headers.Set("Access-Control-Expose-Headers", "Authorization");
      HttpContext.Current.Response.Headers.Set("Authorization", "test");
  
      //HttpContext.Current.Response.Headers.Set("Access-Control-Allow-Methods", "GET, OPTIONS");
      //HttpContext.Current.Response.Headers.Set("Access-Control-Allow-Credentials", "true");
      //HttpContext.Current.Response.Headers.Set("Access-Control-Allow-Origin", "http://run.plnkr.co/");
      return response;
  }
  </code></pre>
  
  <p>The commented out code is just some of the many combinations of Header configurations I used to try and solve this problem.  After the web api, I created an extremely basic api call in plunker:</p>
  
  <pre><code>var Test1 = function() {
      $.ajax("http://localhost:61826/api/auth/token", {
          type: "GET",
          success: function(data, status, xhr) {  
              debugger;
          },
          error: function(err) {
              debugger;
          },
          crossDomain: true
      });
  }
  </code></pre>
  
  <p>I also created a version in angular, which I'll share if anybody needs it. </p>
  
  <p>The end result. In chrome, it works wonderfully, as you can see here (Authorization header is there):</p>
  
  <p><img src="https://i.stack.imgur.com/OjQgh.jpg" alt="enter image description here"></p>
  
  <p>But in Safari it doesn't work, as you can see here (Authorization header missing):
  <img src="https://i.stack.imgur.com/VeUtM.jpg" alt="enter image description here"></p>
  
  <p>I've been banging my head against the wall for a number of days on this one, and it's time to bring in the community. Can anybody tell me what the heck is going on??</p>