title: CORS POST Requests not working - OPTIONS (Bad Request) - The origin is not allowed
body: <p>I'm having a lot of trouble getting a cross domain POST request to hit an Api controller in the latest beta 2 release.</p>
  
  <p>Chrome (and other browsers) spit out:</p>
  
  <pre><code>OPTIONS http://api.hybridwebapp.com/api/values 400 (Bad Request)
  POST http://api.hybridwebapp.com/api/values 404 (Not Found) 
  </code></pre>
  
  <p>It may be related to <a href="https://aspnetwebstack.codeplex.com/workitem/954" rel="noreferrer">this issue</a> but I have applied that workaround and several other fixes such as web.config <a href="https://stackoverflow.com/questions/12521499/cors-support-for-put-and-delete-with-asp-net-web-api">additions here</a> </p>
  
  <p>I've been banging my head with this for a while so I created a solution to reproduce the problem exactly.</p>
  
  <p>Load the web app there will be 2 buttons one for GET one for POST and the response will appear next to the button. GET works. Cannot get POST to return successfully.</p>
  
  <p><img src="https://i.stack.imgur.com/VBsBf.png" alt="enter image description here"></p>
  
  <p>I'm able to get a hint at the cause from Fiddler but it makes no sense because if you look at the response it DOES include the domain in the Access-Controll-Allow-Origin header:</p>
  
  <p><img src="https://i.stack.imgur.com/nCMwC.png" alt="enter image description here"></p>
  
  <p>There is a folder in the solution called "ConfigurationScreenshots" with a few screenshots of the IIS configuration (website bindings) and Project properties configurations to make it as easy as possible to help me :)</p>
  
  <p>EDIT: Don't forget to add this entry to host file (%SystemRoot%\system32\drivers\etc):</p>
  
  <pre><code> 127.0.0.1     hybridwebapp.com  api.hybridwebapp.com
  </code></pre>
  
  <p>**STATUS: ** It seems that some browsers like Chrome allow me to proceed with the POST regardless of the error message in the OPTIONS response (while others like Firefox don't). But I don't consider that solved.</p>
  
  <p>Look at the Fidler screenshots of the OPTIONS request it has </p>
  
  <p>Access-Control-Allow-Origin: <a href="http://hybridwebapp.com" rel="noreferrer">http://hybridwebapp.com</a></p>
  
  <p>And yet the error:</p>
  
  <p>The origin <a href="http://hybridwebapp.com" rel="noreferrer">http://hybridwebapp.com</a> is not allowed</p>
  
  <p>That is completely contradictory it's as if it's ignoring the header.</p>