title: WCF handling CORS & Options VERB
body: <p>I have a wcf service hosted on IIS. 
  Almost all the documents say that to enable cors, you should handle the OPTIONS VERB. (Pre-Flight Requests)</p>
  
  <p>I have a method whose signatures are : </p>
  
  <pre><code>[OperationContract]
          [FaultContract(typeof(ExceptionManager))]
          [WebInvoke(Method = "POST",
              RequestFormat = WebMessageFormat.Json,
              ResponseFormat = WebMessageFormat.Json,
              BodyStyle = WebMessageBodyStyle.WrappedRequest,
              UriTemplate = "PostLog")]
          string PostLog(List&lt;LoginEntry&gt; LoginLog);
  </code></pre>
  
  <p>I have created an attribute deriving from IServiceBehavior &amp; hooked up this Class to my service &amp; handled BeforeSendReply method to add Acces Control methods as : </p>
  
  <pre><code>public void BeforeSendReply(ref System.ServiceModel.Channels.Message reply, object correlationState)
  {
  
      var httpHeader = reply.Properties["httpResponse"] as HttpResponseMessageProperty;
      httpHeader.Headers.Add("Access-Control-Allow-Origin", "*");
  
      httpHeader.Headers.Add("Access-Control-Request-Method", "POST,GET,PUT,DELETE,OPTIONS");
      httpHeader.Headers.Add("Access-Control-Allow-Headers", "X-Requested-With,Content-Type");
  
  }
  </code></pre>
  
  <p>This did not help me when i created a testcall in firefox. So i took it out from here &amp; added this in Global.asax file as</p>
  
  <pre><code>protected void Application_BeginRequest(object sender, EventArgs e)
          {
                             HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.NoCache);
  
              HttpContext.Current.Response.Cache.SetNoStore();
  
              HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");
  
              if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
              {
  
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
  
                  HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Accept");
  
                  HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
  
                  HttpContext.Current.Response.End();
  
              }
          }
  </code></pre>
  
  <p>I could see in firefox 403 Error &amp; my headers not being present. 
  so i went ahead &amp; put those headers in IIS settings (Custom headers Tab).  (I took the risk of sending those in each response). 
  Now i can see those headers in response in firefox, but I am still getting 403 Error. 
  This is the response header : </p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Connection: Keep-Alive
  Content-Length: 1758
  Date: Thu, 05 Mar 2015 14:47:25 GMT
  Content-Type: text/html
  Server: Microsoft-IIS/6.0
  X-Powered-By: ASP.NET
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, OPTIONS
  Access-Control-Allow-Headers: Content-Type, Authorization, Accept
  </code></pre>
  
  <p>I also tried Changing to Method="*" in WebInvoke. but still could not get it to work.</p>
  
  <p>Thanks in Advance..</p>