title: WebAPI CORS with Windows Authentication - allow Anonymous OPTIONS request
body: <p>I have a WebAPI 2 REST service running with Windows Authentication.  It is hosted separately from the website, so I've enabled CORS using the ASP.NET CORS NuGet package.  My client site is using AngularJS.  </p>
  
  <p>So far, here's what I've been through:</p>
  
  <ol>
  <li>I didn't have withCredentials set, so the CORS requests were returning a 401.  Resolved by adding withCredentials to my $httpProvider config.</li>
  <li>Next, I had set my EnableCorsAttribute with a wildcard origin, which isn't allowed when using credentials.  Resolved by setting the explicit list of origins.</li>
  <li>This enabled my GET requests to succeed, but my POST issued a preflight request, and I hadn't created any controller actions to support the OPTIONS verb.  To resolve this, I've implemented a MessageHandler as a global OPTIONS handler.  It simply returns 200 for any OPTIONS request.  I know this isn't perfect, but works for now, in Fiddler.</li>
  </ol>
  
  <p>Where I'm stuck - my Angular preflight calls aren't including the credentials.  According to <a href="https://stackoverflow.com/a/22100516/323463">this answer</a>, this is by design, as OPTIONS requests are designed to be anonymous.  However, the Windows Authentication is stopping the request with a 401.</p>
  
  <p>I've tried putting the [AllowAnonymous] attribute on my MessageHandler.  On my dev computer, it works - OPTIONS verbs do not require authentication, but other verbs do.  When I build and deploy to the test server, though, I am continuing to get a 401 on my OPTIONS request.</p>
  
  <p>Is it possible to apply [AllowAnonymous] on my MessageHandler when using Windows Authentication?  If so, any guidance on how to do so?  Or is this the wrong rabbit hole, and I should be looking at a different approach?</p>
  
  <p>UPDATE:
  I was able to get it to work by setting both Windows Authentication and Anonymous Authentication on the site in IIS.  This caused everything to allow anonymous, so I've added a global filter of Authorize, while retaining the AllowAnonymous on my MessageHandler.  </p>
  
  <p>However, this feels like a hack...I've always understood that only one authentication method should be used (no mixed).  If anyone has a better approach, I'd appreciate hearing about it.</p>