title: CORS Error on browser back button
body: <p>I have a ASP.NET Web API 2 Service. And multiple client(angular) applications talks to that service. the applications and the service are published on different sub domains, like the following:</p>
  
  <blockquote>
    <p>service.mydomain.com</p>
    
    <p>app1.mydomain.com</p>
    
    <p>app2.mydomain.com</p>
  </blockquote>
  
  <p>I used Microsoft.AspNet.WebApi.Cors - NuGet package to enable CORS, it is working fine, except for one scenario:
  When the user opens one application (app1.mydomain.com). 
  Then navigates to another (app2.mydomain.com). Then presses the browser back button. the follwoing CORS Error:</p>
  
  <pre><code>The 'Access-Control-Allow-Origin' header has a value 'http://app2.mydomain.com' that is not equal to the supplied origin. 
  Origin 'http://app1.mydomain.com' is therefore not allowed access
  </code></pre>
  
  <p>I Configured The Microsoft.AspNet.WebApi.Cors - NuGet package, as follows:</p>
  
  <pre><code>public static void Register(HttpConfiguration config)
          {
          var cors = new EnableCorsAttribute(
                  //to-do allow cross domains for all maarif.com sites
                  origins: "*", //and also tried "http://app1.mydomain.com, http://app2.mydomain.com" gives same result
                  headers: "*",
                  methods: "*") {SupportsCredentials = true};
  
              config.EnableCors(cors);
          }
  </code></pre>
  
  <p>I traced the Origin header values on the server.
  I put the following code in the service 'global.asax' :</p>
  
  <pre><code>protected void Application_BeginRequest()
          {
              var origin = HttpContext.Current.Request.Headers["Origin"];
  
              if (origin != null )
              {
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", origin);
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "*");
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "*");
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Credentials", "true");
              }
          }
  </code></pre>
  
  <p>The problem happens when user clicks back button form 'app2.mydomain.com' to 'app1.mydomain.com', the origin sent with the request is 'app2.mydomain.com', and there that is what the service allows access to: <code>HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", 'app2.mydomain.com');</code></p>
  
  <p>Any Way around this?</p>
  
  <p>Note that I can't put '*' because the requests are authenticated.</p>