title: Why is CORS complaining: 'No Access-Control-Allow-Origin' / '500 (Internal Server Error)', even though it looks configured correctly?
body: <h2>Briefing</h2>
  
  <p>I am aware what CORS is, and how it works.
  Lately, I performed a big update on my application.
  Since then, my Client Application cannot connect to the backend due to the CORS error.</p>
  
  <p>My Admin Application has no problems connecting to the BE.
  I compared the web.configs and a couple of other files, and cannot see much of a difference in the Client configuration.</p>
  
  <p>(Admin: FE=MVC5/ASP | BE= ASP.NET)</p>
  
  <p>(Client: FE= Angular 8.1 | BE= ASP.NET)</p>
  
  <p>Changelog of what happened in the update:</p>
  
  <ul>
  <li>Implemented Unity Dependency Injection for the Web Controllers</li>
  <li>Made all the WebControllers inherit from a BaseController that handles the DI</li>
  <li>Updated a couple of Microsoft.AspNet "Web" Nugets from v5.2.3 -> 5.2.7</li>
  </ul>
  
  <p>Cors has worked without any issue before this. I looked at my file changes in my git client and could not find any changes to files that could relate to this CORS issue at first glance.</p>
  
  <p><em>If you need more information or more insight into specific files, let me know in the comments and I will provide them.</em></p>
  
  <hr>
  
  <h2>Code Snippets</h2>
  
  <p>Config-based CORS configuration is commented out (by a previous developer) in <strong>Web.Config</strong>:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;!--&lt;add name="Access-Control-Allow-Methods" value="GET, POST" /&gt;
          &lt;add name="Access-Control-Allow-Headers" value="Origin, Content-Type, X-Auth-Token" /&gt;
          &lt;add name="Access-Control-Allow-Origin" value="http://localhost:4200" /&gt;
          &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;--&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>When I uncomment this, and change the origin to my server,
  the "No-Access-Control-Origin" error disappers, but I get error 500 (Internal Server Error) instead.</p>
  
  <p>CORS is configured via the <strong>WebApiConfig</strong>, this class gets executed and loaded, I checked that with a breakpoint. I tried both <code>new EnableCorsAttribute("subdomain.ourdomain.com",...</code> and <code>new EnableCorsAttribute("*",...</code> ...To no avail.</p>
  
  <pre class="lang-cs prettyprint-override"><code>public static class WebApiConfig
      {
          public static void Register(HttpConfiguration config)
          {
              // Web API configuration and services
  
              var cors = new EnableCorsAttribute("*", "*", "*");
              cors.SupportsCredentials = true;
              config.EnableCors(cors);
  
              // Web API routes
              config.MapHttpAttributeRoutes();
  
              config.Routes.MapHttpRoute(
                  name: "DefaultApi",
                  routeTemplate: "api/{controller}/{id}",
                  defaults: new { id = RouteParameter.Optional }
              );
          }
      }
  </code></pre>
  
  <p>Obviously I have googled, and found the <a href="https://enable-cors.org/server_aspnet.html" rel="nofollow noreferrer">Enable-Cors.org</a> for ASP.NET, which all looks really good.</p>
  
  <p>I have checked my WebApiConfig against what is described as the global CORS approach on that page, and to me it looks like that my WebApiConfig.cs is configured correctly.</p>
  
  <p>I am a little stuck here.</p>