title: Sudden CORS violation at localhost/token
body: <p>I've got a solution with two projects. 
  - One Web Api (using owin middleware and Oauth for authentication) (located at localhost:2111)
  - Frontend app that communicates with the API.  (located at localhost:1634)</p>
  
  <p>Hosted on different local domains to make sure that everything related to cross-origin resource sharing is working.</p>
  
  <p>And everything worked like a charm, when working from home for a couple of months. Now when I am out trevelling and is running the project on other locations I noticed that, for some reason, the CORS handling freaked out. I will try to explain what was happening.</p>
  
  <ul>
  <li>I run the projects, first the Api and then the frontend.</li>
  <li>I go to the frontend sign in page and trigger a post to the /token endpoint(auth and get a token)</li>
  <li>First error, <code>http://localhost:2111/token</code> CORS violation, even though this has never been a problem from home.</li>
  <li><p>I googled it and found two different "solutions".</p></li>
  <li><p>First, add: <code>context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });</code> to the <code>GrantResourceOwnerCredentials</code> method. <strong>This did not work.</strong></p></li>
  <li><p>Second, add this to your web.config: </p></li>
  </ul>
  
  <p><code>&lt;httpProtocol&gt;
      &lt;customHeaders&gt;
        &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
        &lt;add name="Access-Control-Allow-Methods" value="GET, POST, OPTIONS, PUT, DELETE" /&gt;
      &lt;/customHeaders&gt;
    &lt;/httpProtocol&gt;</code></p>
  
  <p>Ok, now something actually did happend. The CORS error was replaced by another error message complaining over multiple headers. I figured out that this must be because of <code>app.UseCors(CorsOptions.AllowAll)</code> in my Startup.cs file. <strong>I removed it...and was able to sign in again! what a feeling.</strong>. The happiness did not last long... </p>
  
  <p>The price to be able to login is that <em>ALL</em> my Api methods are dissallowed, darn. So I restored the code, removed the customHeaders from the web.config and added the app.UseCors() again, (back to normal).</p>
  
  <p>Guess what, now everything works! After doing the above steps I did not get any errors. </p>
  
  <p>But doing this everytime I turn on the computer and launch the project is just not right.
  <strong>What is happening here and how do i fix it?</strong>.</p>
  
  <p>Why did this work for months at home but not from other places? It's only localhost developing and testing taking place here...</p>