title: Angular4 ASP.NET Core 1.2 Windows Authentication CORS for PUT and POST Gives 401
body: <p>My IDE is Visual Studio 2017.  I've got an Angular4 client talking to a WebAPI backend in Core, and CORS is working as configured EXCEPT for the PUT and POST methods. The GET method is subject to the same preflight OPTIONS method in Chrome that the PUT and POST methods are, but GET is working fine.</p>
  
  <p>It appears that the IIS Express server in Visual Studio is not forwarding the requests to the Kestrel server.  Both Methods work in Postman, but not when Angular4 makes the call.  Here's the code:</p>
  
  <p><strong>Angular4 POST</strong></p>
  
  <pre><code>post(api: string, object: any): Observable&lt;any&gt; {
          let body = JSON.stringify(object);
  
          let options = new RequestOptions({
              headers: this.headers,
              withCredentials: true
              });
  
          return this.http.post(this.server + api, body, options)
              .map((res: Response) =&gt; res.json())
              .catch((error: any) =&gt; Observable.throw(error.json().error) || 'Post server error');
      }
  </code></pre>
  
  <p><strong>Startup.cs Configure</strong></p>
  
  <pre><code>services.Configure&lt;IISOptions&gt;(options =&gt; 
       options.ForwardWindowsAuthentication = true);
  
  services.AddCors(options =&gt; {
              options.AddPolicy("AllowAll", builder =&gt; {
                  builder.WithOrigins("http://localhost:XXXX")
                  .WithMethods("GE‌​T", "POST", "PUT", "DELETE", "OPTIONS")
                  .WithHeaders("Origin", "X-Requested-With", "Content-Type", "Accept", "Authorization")
                  .AllowCredentials();
              });
          });
  </code></pre>
  
  <p><strong>Startup.cs ConfigureServices</strong></p>
  
  <pre><code>app.UseCors("AllowAll");
  </code></pre>
  
  <p><strong>IIS ApplicationHost.Config in Project</strong></p>
  
  <pre><code>&lt;anonymousAuthentication enabled="false" userName="" /&gt;
      &lt;basicAuthentication enabled="false" /&gt;
      &lt;clientCertificateMappingAuthentication enabled="false" /&gt;
      &lt;digestAuthentication enabled="false" /&gt;
      &lt;iisClientCertificateMappingAuthentication enabled="false"&gt;&lt;/iisClientCertificateMappingAuthentication&gt;
      &lt;windowsAuthentication enabled="true" &gt;
        &lt;providers&gt;
          &lt;add value="Negotiate" /&gt;
        &lt;/providers&gt;
      &lt;/windowsAuthentication&gt;
  </code></pre>
  
  <p><strong>AND</strong></p>
  
  <pre><code>&lt;customHeaders&gt;
      &lt;clear /&gt;
      &lt;add name="X-Powered-By" value="ASP.NET" /&gt;
      &lt;add name="Access-Control-Allow-Origin" value="http://localhost:5000"/&gt;
      &lt;add name="Access-Control-Allow-Headers" value="Accept, Origin, Content-
          Type"/&gt;
      &lt;add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, 
          OPTIONS"/&gt;
      &lt;add name="Access-Control-Allow-Credentials" value="true"/&gt;
  &lt;/customHeaders&gt;
  </code></pre>
  
  <p><strong>Response for GET</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
  Transfer-Encoding: chunked
  Content-Type: application/json; charset=utf-8
  Server: **Kestrel**
  X-SourceFiles: =?UTF-8?B?QzpcZGV2cHJvamVjdHNcVFJXRC5IeWRyb21hcnRBZG1pblxKVF9BZGRUYWdNYW5hZ2VtZW50XFRSV0QuSHlkcm9NYXJ0LkFwcFxhcGlcdGFncw==?=
  Persistent-Auth: true
  X-Powered-By: ASP.NET
  Access-Control-Allow-Origin: http://localhost:5000
  Access-Control-Allow-Headers: Accept, Origin, Content-Type
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Credentials: true
  Date: Fri, 14 Jul 2017 17:03:43 GMT
  </code></pre>
  
  <p><strong>Response for POST</strong></p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Server: Microsoft-IIS/10.0
  X-SourceFiles: =?UTF-8?B?QzpcZGV2cHJvamVjdHNcVFJXRC5IeWRyb21hcnRBZG1pblxKVF9BZGRUYWdNYW5hZ2VtZW50XFRSV0QuSHlkcm9NYXJ0LkFwcFxhcGlcdGFncw==?=
  WWW-Authenticate: Negotiate
  X-Powered-By: ASP.NET
  Access-Control-Allow-Origin: http://localhost:5000
  Access-Control-Allow-Headers: Accept, Origin, Content-Type
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Credentials: true
  Date: Fri, 14 Jul 2017 17:05:11 GMT
  Content-Length: 6095
  </code></pre>
  
  <p>So the big question is, what am I missing?</p>