title: Cannot get CORS to work in Visual Studio (works on DEV pair of servers, won’t work on TEST pair of servers)
body: <p>We have split servers – WEBAPI’s on a separate server.  I got my app working across split servers in DEV, but I’ve moved the same code to the pair of TEST servers and it’s not working.  I cannot figure out why.  It seems like it must be something different with the TEST WebApi server but I don’t know where to look and don’t have access to it to look under the hood without asking systems people to do it for me.</p>
  
  <p>Software being used: Visual Studio 2017, C#, Javascript, HTML/CSS, Oracle, Entity Framework 6, Breeze, IIS 10</p>
  
  <p>I installed NuGet packages: Microsoft.AspNet.WebApi.Cors 5.2.7, and Microsoft.AspNetCore.Mvc.Cors 2.2.0.</p>
  
  <p>In my \WebAPI\App_Start\WebApiConfig.cs, I added the EnableCors:</p>
  
  <pre><code>public static void Register(HttpConfiguration config)
  {
      // Web API configuration and services
      config.EnableCors();
  
      // Web API routes
      config.MapHttpAttributeRoutes();
  </code></pre>
  
  <p>And in my BREEZE and MVC Controllers, I added the EnableCors with the 3 origins for DEV, TEST, and PREPROD environments (I did discover that the presence of the [Authorize] attribute causes it not to work.  Had to comment that out):</p>
  
  <pre><code>using System.Web.Http.Cors;
  
  namespace SCC.WebAPI.Controllers
  {
      //[Authorize]    
      [BreezeController]
      [EnableCors(origins: “http://webdevint.scc.state.va.us,http://in.scctest2new.scc.state.va.us,http://in.sccpreweb5.scc.state.va.us", headers: "*", methods: "*")]
      public class LookupController : ApiController
      {
  </code></pre>
  
  <p>DEV is working, TEST is not.</p>
  
  <p>On DEV – I get the Access-Control-Allow-Origin header required by CORS:</p>
  
  <p>Origin (in my EnableCors): WEBDEVINT server --> Webapi: SCCDEVCS server</p>
  
  <p><a href="https://i.stack.imgur.com/FuJwz.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FuJwz.jpg" alt="enter image description here"></a></p>
  
  <p>On TEST – I get an error:</p>
  
  <p>Origin (in my EnableCors): SCCTEST2NEW server --> Webapi: SCCTESTAPP server</p>
  
  <pre><code>ERROR: “Access to XMLHttpRequest at 'http://scctestapp.scc.state.va.us/EFIWEBAPI/breeze/Lookup/Metadata' from origin 'http://in.scctest2new.scc.state.va.us' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.”
  </code></pre>
  
  <p>If I drop in the URL it’s trying to reach into the address bar: <code>'http://scctestapp.scc.state.va.us/EFIWEBAPI/breeze/Lookup/Metadata',</code> </p>
  
  <p>it works just fine.  Returns the metadata.  So I know the URL being requested is correct.</p>
  
  <p>Note:  I also tried the following in my Controllers and it didn’t work any differently - I know that's a bit of a security risk to allow any server to originate messages:</p>
  
  <pre><code>[EnableCors(origins: "*", headers: "*", methods: "*")]
  </code></pre>
  
  <p>It seems like there is something different on the TEST server vs. the DEV server.  But I had the two webapps (UI and WebAPI) set up in IIS exactly the same way on DEV and on TEST.  </p>
  
  <p>Could it be an IIS setting that needs to be set?  Could it be something in the GAC?  I don’t know where to start looking.  Thanks for any advice.</p>
  
  <p>Edit:
  I also tried adding the following lines to the WebAPI web.config with and without the Credentials line:</p>
  
  <pre><code>  &lt;system.webServer&gt;
      &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="http://in.scctest2new.scc.state.va.us" /&gt;
          &lt;add name="Access-Control-Allow-Headers" value="*" /&gt;
          &lt;add name="Access-Control-Allow-Methods" value="*" /&gt;
          &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>But it gives me a 401 Unauthorized on the Metadata call.  Not sure what Credentials it's looking for.</p>