title: Azure WebApp Cors does not add Cors headers
body: <p>I have an Owin WebAPI2 .NET app that I host on an AppService in Azure.</p>
  
  <p>I want to add CORS support using Azure as <a href="https://docs.microsoft.com/en-us/azure/app-service-api/app-service-api-cors-consume-javascript" rel="nofollow noreferrer">in this article</a>. It seems simple, you just add an Origin site to the list like this: <a href="http://screencast.com/t/r2ATq4u5" rel="nofollow noreferrer">http://screencast.com/t/r2ATq4u5</a></p>
  
  <p>I would now expect the Response headers to contain this allowed Origin.</p>
  
  <p>However, the CORS headers are not included in the Response Headers when I check it with Fiddler:
  <a href="http://corstestqm.azurewebsites.net/breeze/restaurantsbreeze/basictest" rel="nofollow noreferrer">http://corstestqm.azurewebsites.net/breeze/restaurantsbreeze/basictest</a></p>
  
  <p>Steps I have tried:</p>
  
  <ul>
  <li>Stripped out all CORS Nuget libraries from my solution and all traces of CORS code in my API project.</li>
  <li>Deployed to a brand new AppService</li>
  <li><a href="http://benfoster.io/blog/aspnet-webapi-cors" rel="nofollow noreferrer">Enabled Owin Cors</a> AllowAll </li>
  </ul>
  
  <p>None of these had any effect. (ie. the Response does not contain the CORS header specified in Azure).</p>
  
  <p>Am I missing something really basic here?</p>
  
  <p><strong>UPDATE</strong>
  I simplified the problem even more:
  In VS2015, I created a new API project and pushed it to <a href="http://corstestbasicap2.azurewebsites.net/api/values/" rel="nofollow noreferrer">http://corstestbasicap2.azurewebsites.net/api/values/</a>
  with no changes (ie. it should NOT have CORS enabled). </p>
  
  <p>I then use <a href="http://www.test-cors.org/#?client_method=GET&amp;client_credentials=false&amp;server_url=http%3A%2F%2Fcorstestbasicap2.azurewebsites.net%2Fapi%2Fvalues%2F&amp;server_enable=true&amp;server_status=200&amp;server_credentials=false&amp;server_tabs=remote" rel="nofollow noreferrer">Test-Cors tool</a> to hit that API. It does not get a CORS error as expected. I then go into Azure and add a dummy URL (e.g <a href="http://www.example.com" rel="nofollow noreferrer">http://www.example.com</a>) and try the CORS test again. It should fail as Azure should only let example.com through. However, it works fine.</p>
  
  <p>I then <a href="http://screencast.com/t/JZFDhQq9kC" rel="nofollow noreferrer">edit CORS again in Azure</a> and add <a href="http://www.test-cors.org" rel="nofollow noreferrer">http://www.test-cors.org</a> below <a href="http://www.example.com" rel="nofollow noreferrer">http://www.example.com</a> (so it should let either through) and now the headers return <code>Access-Control-Allow-Origin:http://www.test-cors.org</code> as expected.</p>
  
  <p>But this makes no sense? Surely the previous call should fail when "<a href="http://www.test-cors.org" rel="nofollow noreferrer">http://www.test-cors.org</a>" was NOT in the allowed Origins? It does not seem to be doing anything useful?!</p>