title: CORS + Windows Authentication not playing nice with Edge or IE
body: <p>I've having a CORS issue that only happens in Edge and IE11. Chrome works fine.</p>
  
  <p>My setup is an ASP.NET MVC5 app (client) that has a script calling out to a separate ASP.NET MVC5 app (API) that only contains WebAPI controllers. Security in both apps is through Windows Authentication.</p>
  
  <p>Currently, everything is running on localhost during development.</p>
  
  <p>When the client script makes the call to the API, the OPTIONS preflight works fine. However, when the <code>GET</code> happens, Edge and IE get the following error:</p>
  
  <p><a href="https://i.stack.imgur.com/Jo4vB.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Jo4vB.png" alt="enter image description here"></a></p>
  
  <p>In this image, <code>localhost:50281</code> is the client, and <code>localhost:47205</code> is the API.</p>
  
  <p>Something that is weird, is that the call isn't actually hitting the controller. The controller is decorated with a custom <code>AuthorizeAttribute</code>, and a breakpoint in there doesn't ever get hit.</p>
  
  <h1>Here is how CORS is set up in the API project:</h1>
  
  <p><strong>Global.asax.cs</strong></p>
  
  <pre><code>protected void Application_BeginRequest()
  {
      if (Request.Headers.AllKeys.Contains("Origin") &amp;&amp; Request.HttpMethod == "OPTIONS")
      {
          Response.Headers.Add("Access-Control-Allow-Origin", "http://localhost:50281");
          // Yes, there are too many headers. I've been working on this a while, and there are a few overkill options that have crept in
          Response.Headers.Add("Access-Control-Allow-Headers", "X-AspNet-Version,X-Powered-By,Date,Server,Accept,Accept-Encoding,Accept-Language,Cache-Control,Connection,Content-Length,Content-Type,Host,Origin,Pragma,Referer,User-Agent");
          Response.Headers.Add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, HEAD, OPTIONS");
          Response.Headers.Add("Access-Control-Allow-Credentials", "true");
          Response.Headers.Add("Access-Control-Max-Age", "600");
          Response.End();
      }
  }
  </code></pre>
  
  <p><strong>WebApiConfig.cs</strong></p>
  
  <pre><code>public static void Register(HttpConfiguration config)
  {
      // Web API configuration and services
      var cors = new EnableCorsAttribute("http://localhost:50281", "*", "*");
      cors.SupportsCredentials = true;
      cors.PreflightMaxAge = 600;
      config.EnableCors(cors);
      // Web API routes
      config.MapHttpAttributeRoutes();
  
      config.Routes.MapHttpRoute(
          name: "DefaultApi",
          routeTemplate: "api/{controller}/{id}",
          defaults: new { id = RouteParameter.Optional }
      );
  }
  </code></pre>
  
  <h1>Here is the script function in the client project:</h1>
  
  <pre><code>GetStatus = () =&gt; {
      $.ajax({
          type: "GET",
          url: apiUrl,
          dataType: "json",
          crossDomain: true,
          xhrFields: {
              withCredentials: true
          },
          contentType: "application/json; charset=UTF-8",
          success: (result) =&gt; {
              this.Status(result);
          }
      });
  }
  </code></pre>
  
  <h1>Update</h1>
  
  <p>I modified Global.asax.cs to ensure that the Access-Control-Allow-Origin and Access-Control-Allow-Credentials are included with every request, as was suggested. However, this still results in a 401 only in Edge and IE. It works fine in Chrome.</p>
  
  <h1>Update 2</h1>
  
  <p>I guess something did change. I missed that the error is now reduced to the following:
  <a href="https://i.stack.imgur.com/2PQil.png" rel="noreferrer"><img src="https://i.stack.imgur.com/2PQil.png" alt="enter image description here"></a></p>
  
  <p>This is obviously from me getting the appropriate headers in place. However, for some reason, Edge and IE are still not letting the authentication pass through, despite the presence of <code>withCredentials: true</code>. Is there another piece I'm missing?</p>