title: CORS preflight OPTIONS request returns 401 (Unauthorized) from Windows Authenticated web api
body: <p>I've got a <code>.NET Web API</code> project using <code>Windows Authentication</code>. In my development environment, I can't do a successful <code>POST</code> request with data from my <code>Angular</code> app. It returns:</p>
  
  <pre><code>OPTIONS http://localhost:9090/api/values 401 (Unauthorized)
  Failed to load http://localhost:9090/api/values: Response for preflight has invalid HTTP status code 401.
  </code></pre>
  
  <p>I've tried all means of implementing cors with <code>Microsoft.AspNet.WebApi.Cors</code> to no avail. But currently I've removed the <code>Microsoft.AspNet.WebApi.Cors</code> package from my project in favor of the <code>web.config</code> method <strong>(if I actually still need <code>Microsoft.AspNet.WebApi.Cors</code> installed to do the following in <code>Web.config</code>, plz let me know)</strong>:</p>
  
  <p><strong>Web.config:</strong></p>
  
  <pre><code>&lt;httpProtocol&gt;
    &lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Origin" value="http://localhost:5200" /&gt;
      &lt;add name="Access-Control-Allow-Headers" value="*" /&gt;
      &lt;add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" /&gt;
      &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p><strong>.NET Web API 'ValuesController.cs':</strong></p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Net;
  using System.Net.Http;
  using System.Web.Http;
  
  namespace api.Controllers
  {
      [Authorize]
      public class ValuesController : ApiController
      {
          // GET api/values
          public IEnumerable&lt;string&gt; Get()
          {
              return new string[] { "value1", "value2" };
          }
  
          // GET api/values/5
          public string Get(int id)
          {
              return "value";
          }
  
          // POST api/values
          public void Post([FromBody]string value)
          {
          }
  
          // PUT api/values/5
          public void Put(int id, [FromBody]string value)
          {
          }
  
          // DELETE api/values/5
          public void Delete(int id)
          {
          }
      }
  }
  </code></pre>
  
  <p><strong>Angular Component (sends data to my Angular service):</strong></p>
  
  <pre><code>  constructor(private myService: MyService) {
      this.myService.myPost({ID: 1, FirstName: 'Bob'})
      .subscribe(
        data =&gt; console.warn(data),
        err =&gt; console.error(err),
        () =&gt; console.log("empty")
      );
    }
  </code></pre>
  
  <p><strong>Angular Service (posts the component's data to my <code>Web API</code>):</strong></p>
  
  <pre><code>import { Injectable } from '@angular/core';
  import { HttpClient, HttpResponse, HttpRequest, HttpHeaders, HttpInterceptor, HttpHandler, HttpEvent, HttpParams} from '@angular/common/http';
  
  import { Observable } from 'rxjs';
  import { from } from 'rxjs';
  import { map, filter, catchError, mergeMap } from 'rxjs/operators';
  
  @Injectable({
    providedIn: 'root'
  })
  export class MyService {
  
    constructor(private http: HttpClient) {
  
    };
  
  
    public myPost(body) {
  
        const httpOptions = {
           withCredentials: true
        }
  
        return this.http.post("http://localhost:9090/api/values", body, httpOptions);
  
    }
  
  }
  </code></pre>
  
  <p>From my research it seems that perhaps I need to pass in an <code>Authorization</code> header in my request via my <code>httpOptions</code> variable in the service. But I don't know what to pass as the value for the <code>Authorization</code> property. See the question marks below:
  <strong>MyService.ts</strong></p>
  
  <pre><code>  public myPost(body) {
      const httpOptions = {
        headers: new HttpHeaders({
          'Authorization': '?????'
        }),
        withCredentials: true
      }
        return this.http.post("http://localhost:9090/api/values", body, httpOptions);
    }
  </code></pre>
  
  <p>Maybe this isn't even my problem though. CORS + Windows Authentication - any ideas?</p>