title: CORS policy "Access-Control-Allow-Origin" IIS
body: <p>I have angular , Entity Framework and MS SQL server. I need to have Backend set on MS IIS because I need to have domain authentication. 
  Unluckily I still get problems with CORS. </p>
  
  <p>When I have in my web.config file: </p>
  
  <pre><code>&lt;httpProtocol&gt;
          &lt;customHeaders&gt;
              &lt;add name="Access-Control-Allow-Origin" value="http://localhost" /&gt;
              &lt;add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" /&gt;
              &lt;add name="Access-Control-Allow-Headers" value="Content-Type" /&gt;
          &lt;/customHeaders&gt;
        &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>I get in the browser:
  "has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value '<a href="http://localhost" rel="nofollow noreferrer">http://localhost</a>' that is not equal to the supplied origin" </p>
  
  <p>When I change it to:</p>
  
  <pre><code>&lt;httpProtocol&gt;
          &lt;customHeaders&gt;
              &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
              &lt;add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" /&gt;
              &lt;add name="Access-Control-Allow-Headers" value="Content-Type" /&gt;
          &lt;/customHeaders&gt;
        &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>I get:
  "has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute."</p>
  
  <p>Any idea what should I change?</p>
  
  <p>Next changes:</p>
  
  <pre><code>&lt;httpProtocol&gt;
          &lt;customHeaders&gt;
              &lt;add name="Access-Control-Allow-Origin" value="" /&gt;
              &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
              &lt;add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" /&gt;
              &lt;add name="Access-Control-Allow-Headers" value="Content-Type" /&gt;
          &lt;/customHeaders&gt;
        &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>Error in browser: "has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains the invalid value 'true'."</p>
  
  <p>In fiddler I can see:
  Security
     Access-Control-Allow-Origin: true</p>
  
  <p>It looks like the values are not being added to given headers.</p>
  
  <p>Next change: I installed CORS module for IIS and the file looks like:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
      &lt;system.webServer&gt;
          &lt;cors enabled="true" failUnlistedOrigins="true"&gt;
              &lt;add origin="http://localhost:4200"
                   allowCredentials="true"
                   maxAge="120"&gt; 
                  &lt;allowHeaders allowAllRequestedHeaders="true"&gt;
                      &lt;add header="header1" /&gt;
                  &lt;/allowHeaders&gt;
                  &lt;allowMethods&gt;
                       &lt;add method="GET, POST" /&gt;
                  &lt;/allowMethods&gt;
              &lt;/add&gt;
          &lt;/cors&gt;
      &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>The answer in browser now is:
  "HTTP Error 404.0 - Not Found
  The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
  "
  Is it better now?
  What could be next steps?</p>