title: WebApi v2 ExceptionHandler not called
body: <p>How comes that a custom <code>ExceptionHandler</code> is never called and instead a standard response (not the one I want) is returned?</p>
  
  <p>Registered like this</p>
  
  <pre><code>config.Services.Add(typeof(IExceptionLogger), new ElmahExceptionLogger());
  config.Services.Replace(typeof(IExceptionHandler), new GlobalExceptionHandler());
  </code></pre>
  
  <p>and implemented like this</p>
  
  <pre><code>public class GlobalExceptionHandler : ExceptionHandler
  {
      public override void Handle(ExceptionHandlerContext context)
      {
          context.Result = new ExceptionResponse
          {
              statusCode = context.Exception is SecurityException ? HttpStatusCode.Unauthorized : HttpStatusCode.InternalServerError,
              message = "An internal exception occurred. We'll take care of it.",
              request = context.Request
          };
      }
  }
  
  public class ExceptionResponse : IHttpActionResult
  {
      public HttpStatusCode statusCode { get; set; }
      public string message { get; set; }
      public HttpRequestMessage request { get; set; }
  
      public Task&lt;HttpResponseMessage&gt; ExecuteAsync(CancellationToken cancellationToken)
      {
          var response = new HttpResponseMessage(statusCode);
          response.RequestMessage = request;
          response.Content = new StringContent(message);
          return Task.FromResult(response);
      }
  }
  </code></pre>
  
  <p>and thrown like this (test)</p>
  
  <pre><code>throw new NullReferenceException("testerror");
  </code></pre>
  
  <p>in a controller or in a repository.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I do not have another <code>ExceptionFilter</code>.</p>
  
  <p>I found a trigger for this behavior:</p>
  
  <p>Given URL</p>
  
  <pre><code>GET http://localhost:XXXXX/template/lock/someId
  </code></pre>
  
  <p>sending this header, my <code>ExceptionHandler</code> works</p>
  
  <pre><code>Host: localhost:XXXXX
  </code></pre>
  
  <p>sending this header, it doesn't work and the built-in handler returns the error instead</p>
  
  <pre><code>Host: localhost:XXXXX
  Origin: http://localhost:YYYY
  </code></pre>
  
  <p>This might be an issue with CORS requests (I use the WebAPI CORS package globally with wildcards) or eventually my ELMAH logger. It also happens when hosted on Azure (Websites), though the built-in error handler is different.</p>
  
  <p>Any idea how to fix this?</p>