title: Enabling CORS between Ajax and WCF service
body: <p><strong>Problem</strong></p>
  
  <p>Whenever I try to sent a <code>POST</code> request to my WCF service (running locally on IIS), I get:</p>
  
  <blockquote>
    <p>Access Denied</p>
  </blockquote>
  
  <p><strong>My WCF config (relevant code only)</strong></p>
  
  <p>I added the below to allow the different methods, and I'm able to get the info from a <code>Request Method: 'GET'</code>, but not a <code>POST</code></p>
  
  <pre><code>&lt;system.webServer&gt;
  &lt;httpProtocol&gt;
    &lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Origin" value="*"/&gt;
      &lt;add name="Access-Control-Allow-Headers" value="Content-Type, Accept" /&gt;
      &lt;add name="Access-Control-Allow-Methods" value="GET,POST,DELETE" /&gt;
      &lt;add name="Access-Control-Max-Age" value="1728000" /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>Ajax call</strong></p>
  
  <p>Here is my ajax call, whenever I try to create a new <code>'Project'</code></p>
  
  <pre><code>$.ajax({
      url: baseAddress + "projects/create",
      type: 'POST',
      contentType: "application/json; charset=utf-8",
      data: JSON.stringify({
          'Title': 'Test Title',
          'Customer': {
              'Name': 'Test Name'
          }
      })
  })
  </code></pre>
  
  <p><strong>Service implementation</strong></p>
  
  <p>Here's the <code>IService.cs</code> with the <code>UriTemplate</code> and the <code>Method = 'POST'</code></p>
  
  <pre><code>[OperationContract]
  [WebInvoke(Method = "POST", ResponseFormat = WebMessageFormat.Json, UriTemplate = "/projects/create")]
  int CreateProject(ProjectDTO project);
  </code></pre>
  
  <p><strong>EXTRA INFO</strong></p>
  
  <p>Whenever I watch the headers through google chrome, I see the <code>Request Method</code> is <code>OPTIONS</code> and the response <code>Access-Control-Allow-Methods: GET, POST, DELETE</code>, but still, I can't make <code>POST</code> requests (Refer to <a href="http://imgur.com/prc3HMs" rel="nofollow">this</a>).</p>
  
  <p>How do I handle the request method <code>OPTIONS</code> correctly in a WCF service?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>The funny thing is that the response says: <code>Access-Control-Allow-Methods: GET, POST, etc.</code>, which means that since the request asks: <code>Access-Control-Request-Method: POST</code>, it should be allowed to sent this request, but for some reason I get this <code>Access Denied</code></p>
  
  <p><strong>EDIT 2</strong></p>
  
  <p>I'm aware that the <code>Request Method: OPTIONS</code>, but the <code>OPTIONS</code> asks my service if it's allowed to do a <code>POST</code> request, where the service answers back with <code>Access-Control-Allow-Methods: GET, POST, etc.</code> There by saying <code>POST</code> <strong>IS</strong> allowed.</p>