title: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource (POST request with object)
body: <p>I enabled CORS in my web api application</p>
  
  <pre><code>var cors = new EnableCorsAttribute("*", "*", "*");
  config.EnableCors(cors);
  </code></pre>
  
  <p>All the requests are working fine. but <code>when i pass an object to the post method</code> i get this:</p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://localhost:44367/api/Users/Create" rel="noreferrer">http://localhost:44367/api/Users/Create</a>. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).</p>
  </blockquote>
  
  <pre><code>// WORKING
  return axios.post(url)
  return axios.get(url)
  
  
  // NOT WORKING
  
  let model = {
      firstName: 'a',
  }
  
  return axios.post(url, model);
  
  // or with configuration
  
  let axiosConfig = {
              headers: {
                  'Content-Type': 'application/json;charset=UTF-8',
                  "Access-Control-Allow-Origin": true,
                  "Access-Control-Allow-Credentials": true,
              }
          };
  
  return axios.post(url, model, axiosConfig);
  
  </code></pre>
  
  <p>Also posting with postman is working, with the following body</p>
  
  <pre><code>//{
  //  "model" : {
  //      "name":"firstName"
  //  }
  //}
  
  </code></pre>
  
  <p>i have set a break-point in <code>Application_BeginRequest</code> event and it wont hit.</p>
  
  <p>Controller Action</p>
  
  <pre><code>public ClientResponseModel&lt;User&gt; Create([FromBody]UserAddModel model)
  {
     ///.....
  }
  </code></pre>
  
  <p>Request Header</p>
  
  <pre><code>Host: localhost:44367
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
  Accept: */*
  Accept-Language: en,en-US;q=0.5
  Accept-Encoding: gzip, deflate
  Access-Control-Request-Method: POST
  Access-Control-Request-Headers: access-control-allow-credentials,access-control-allow-origin,content-type
  Referer: http://localhost:44346/Registration.aspx
  Origin: http://localhost:44346
  Connection: keep-alive
  </code></pre>
  
  <p>Response Header</p>
  
  <pre><code>HTTP/1.1 200 OK
  Allow: OPTIONS, TRACE, GET, HEAD, POST
  Server: Microsoft-IIS/10.0
  Public: OPTIONS, TRACE, GET, HEAD, POST
  X-SourceFiles: =?UTF-8?B?QzpcVXNlcnNcYWxpLmtcc291cmNlXEF6dXJlXExlYmFuZXNlTGF3c1xDTVNcYXBpXFVzZXJzXENyZWF0ZQ==?=
  X-Powered-By: ASP.NET
  Date: Mon, 24 Feb 2020 13:56:15 GMT
  Content-Length: 0
  </code></pre>
  
  <p>Any help is really appreciated!</p>