title: CORS enabled Web API fails to add header
body: <p>I am using the <code>DynamicPolicyProviderFactory</code> as described <a href="http://msdn.microsoft.com/en-us/magazine/dn532203.aspx" rel="nofollow noreferrer">here</a>.  Below is my version of the DynamicPolicyProviderFactory:</p>
  
  <pre><code>public class DynamicPolicyProviderFactory : ICorsPolicyProviderFactory
  {
      private readonly HashSet&lt;Regex&gt; _allowed;
  
      public DynamicPolicyProviderFactory(IEnumerable allowedOrigins)
      {
          _allowed = new HashSet&lt;Regex&gt;();
  
          foreach (string pattern in allowedOrigins.Cast&lt;string&gt;()
              .Select(Regex.Escape)
              .Select(pattern =&gt; pattern.Replace("*", "w*")))
          {
              _allowed.Add(new Regex(pattern, RegexOptions.IgnoreCase));
          }
  
          if (_allowed.Count &gt;= 1)
              return;
  
          //if nothing is specified, we assume everything is.
          _allowed.Add(new Regex(@"https://\w*", RegexOptions.IgnoreCase));
          _allowed.Add(new Regex(@"http://\w*", RegexOptions.IgnoreCase));
      }
  
      public ICorsPolicyProvider GetCorsPolicyProvider(HttpRequestMessage request)
      {
          var route = request.GetRouteData();
          var controller = (string)route.Values["controller"];
          var corsRequestContext = request.GetCorsRequestContext();
          var originRequested = corsRequestContext.Origin;
          var policy = GetPolicyForControllerAndOrigin(controller, originRequested);
          return new CustomPolicyProvider(policy);
      }
  
      private CorsPolicy GetPolicyForControllerAndOrigin(string controller, string originRequested)
      {
          // Do lookup to determine if the controller is allowed for
          // the origin and create CorsPolicy if it is (otherwise return null)
  
          if (_allowed.All(a =&gt; !a.Match(originRequested).Success))
              return null;
  
          var policy = new CorsPolicy();
          policy.Origins.Add(originRequested);
          policy.Methods.Add("GET");
          policy.Methods.Add("POST");
          policy.Methods.Add("PUT");
          policy.Methods.Add("DELETE");
          return policy;
      }
  }
  
  public class CustomPolicyProvider : ICorsPolicyProvider
  {
      private readonly CorsPolicy _policy;
  
      public CustomPolicyProvider(CorsPolicy policy)
      {
          this._policy = policy;
      }
  
      public Task&lt;CorsPolicy&gt; GetCorsPolicyAsync(HttpRequestMessage request, CancellationToken cancellationToken)
      {
          return Task.FromResult(this._policy);
      }
  }
  </code></pre>
  
  <p>My call to register the cors win the WebApiConfig.cs</p>
  
  <pre><code> config.EnableCors();
   config.SetCorsPolicyProviderFactory(new DynamicPolicyProviderFactory(Settings.Default.AllowedDomains));
  </code></pre>
  
  <p>And my application settings being passed:</p>
  
  <pre><code>&lt;MyApp.Properties.Settings&gt;
    &lt;setting name="AllowedDomains" serializeAs="Xml"&gt;
      &lt;value&gt;
        &lt;ArrayOfString xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
          &lt;string&gt;http://localhost&lt;/string&gt;
          &lt;string&gt;http*://*.domain1.com&lt;/string&gt;
          &lt;string&gt;http*://*.domain2.com&lt;/string&gt;
        &lt;/ArrayOfString&gt;
      &lt;/value&gt;
    &lt;/setting&gt;
  &lt;/MyApp.Properties.Settings&gt;
  </code></pre>
  
  <p></p>
  
  <p>Despite these settings, the <code>Access-Control-Allow-Origin</code> header is not present on my responses if I make a request from <code>http://mg.domain1.com</code> to <code>http://localhost</code>.  I am using Web Api 2.2 and Microsoft.AspNet.Cors 5.2.2.</p>
  
  <p><strong>edit:</strong> I have found that if I use the <code>EnableCors</code> attribute on the controller, or enable it globally (<code>config.EnableCors(new EnableCorsAttribute("*", "*", "*"));</code>) it works, so it must be something with my dynamic factory.  The frustrating thing is, the DynamicPolicyProvider is copy/pasted from another project I am using that works fine.</p>
  
  <p><strong>edit 2:</strong>   Success!...I enabled <a href="http://www.asp.net/web-api/overview/testing-and-debugging/tracing-in-aspnet-web-api" rel="nofollow noreferrer">tracing</a> and found the error</p>
  
  <pre><code> The collection of headers 'accept,content-type' is not allowed
  </code></pre>
  
  <p>So I just edited the <code>GetPolicyForControllerAndOrigin</code> method to allow them.  Now everything works, except I am confused because I did not have to jump through this hoop in my other project (the one I copied the DynamicPolicyProviderFactory from).</p>