title: CORS works for access token but not for refresh token in Web Api 2
body: <p>I have a web api 2 app which I call to using an angularjs client. The web api app is capable of issuing access tokens and refresh tokens for authentication. </p>
  
  <p>Having the following lines in the "GrantResourceOwnersCredentials" method, the CORS is working fine for allowing to issue access tokens:</p>
  
  <pre><code>var allowedOrigin = context.OwinContext.Get&lt;string&gt;("as:clientAllowedOrigin");
    if (allowedOrigin == null) allowedOrigin = "*";
    context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });
  </code></pre>
  
  <p>However, when I try to issue refresh tokens through the angularjs app, I get this good old error in the console:</p>
  
  <pre><code>OPTIONS http://localhost:65141/token
  (index):1 XMLHttpRequest cannot load http://localhost:65141/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:56815' is therefore not allowed access. The response had HTTP status code 400.
  </code></pre>
  
  <p>I was wondering as the access tokens are being issued fine, and the refresh tokens are also issued using the same endpoint, what should I do to overcome this issue?</p>
  
  <p>By the way, the angular code is fine. I disabled google chrome web security and then everything worked! Any help is greatly appreciated!</p>