title: AngularJS and OWIN Authentication on WebApi
body: <p>I have implemented OWIN token based authentication on my WebApi, I have also enabled CORS by calling <code>app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll)</code></p>
  
  <p>I can access various unsecured portions of my app from an angularjs web client. I have used <a href="https://github.com/witoldsz/angular-http-auth/tree/gh-pages">this http-interceptor</a> , when I try to access a protected resource, I get my login pop.</p>
  
  <p>Now in order to login I have to call <code>http://mywebapi/token</code> with form encoded UserName Password and grant_type, see my header signature below (from chrome)</p>
  
  <pre><code>Request URL:http://mywebapi/token
  Request Headers CAUTION: Provisional headers are shown.
  Accept:application/json, text/plain, */*
  cache:false
  Content-Type:application/x-www-form-urlencoded
  Origin:http://127.0.0.1:49408
  Referer:http://127.0.0.1:49408/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
  Form Dataview sourceview URL encoded
  grant_type:password
  UserName:correctuser
  Password:Password
  </code></pre>
  
  <p>When I use postman to send this request, it comes back fine with the expected accesstoken, however when I try to use angular's $http service, it makes the OPTIONS request (I can see this in Dev tools console) but for some reason I get this error message</p>
  
  <pre><code>No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:49408' is therefore not allowed access.
  </code></pre>
  
  <p>NOTE: This only happens for the /token request which is form-url-encoded, for all other json requests the header is added as expected. Can someone please help, I am running out of ideas.</p>
  
  <p>Thanks</p>