title: WebAPI CORS - why is the OPTIONS request making its way into my Controller?
body: <p>I have CORS working with the following: </p>
  
  <pre><code>[System.Web.Http.HttpPut]
  [System.Web.Http.AcceptVerbs("OPTIONS")]
  [System.Web.Http.Route("api/exercise")]
  public HttpResponseMessage UpdateExercise(Exercise exercise) {
      try {
          _adminService.UpdateExercise(exercise);
          return Request.CreateResponse(HttpStatusCode.OK, "Success");
      } catch (Exception e) {
          return Request.CreateResponse(HttpStatusCode.InternalServerError, e);
      }
  }
  </code></pre>
  
  <p>In my <code>global.asax</code>: </p>
  
  <pre><code>protected void Application_BeginRequest() {
      if (Request.Headers.AllKeys.Contains("Origin") &amp;&amp; Request.HttpMethod == "OPTIONS") {
          Response.Flush();
      }
  }
  </code></pre>
  
  <p>But something weird is happening - if I set a breakpoint in my controller, the OPTIONS request makes its way to the innards with a <code>null</code> exercise.  Why is this happening?  I would expect the <code>Flush()</code> to prevent this.  </p>
  
  <p>As it stands, I need to add checks for null to all of my CORS-sensitive endpoints (PUTs, DELETEs).  This seems inelegant... should I be able to prevent OPTIONS requests from hitting the controller logic, instead just responding with the required headers straight-away?</p>