title: OPTIONS method not request with credentials, 401
body: <p>I was try to post some data with fetch to an API server.
  The server was an ASP.NET Web API, .NET Framework v4.5. Published on IIS and only enable Windows Authentication.</p>
  
  <p>However, the post's preflight's request header was not contain cookie. So I got a '401 Unauthorized' error.</p>
  
  <p>My fetch request code, and request header from chrome.</p>
  
  <pre><code>fetch(url,
  {
      method: 'POST',
      mode: 'cors',
      headers: {
          'Accept': 'application/json, text/plain, */*',
          'Content-Type': 'application/json'
      },
      body: JSON.stringify(loaItem),
      credentials: 'include'
  })
  
  
  OPTIONS /api/loasdup HTTP/1.1
  Host: localhost:4501
  Connection: keep-alive
  Access-Control-Request-Method: POST
  Origin: http://localhost:8081
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, 
  like Gecko) Chrome/67.0.3396.99 Safari/537.36
  Access-Control-Request-Headers: content-type
  Accept: */*
  Referer: http://localhost:8081/loa/copy/LOA201807120000
  Accept-Encoding: gzip, deflate, br
  Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
  </code></pre>
  
  <p>Any ideas?</p>
  
  <p>Response Headers in IIS: </p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: *
  Access-Control-Allow-Methods: *
  Access-Control-Allow-Origin: http://localhost:8081
  </code></pre>
  
  <p>The request and response details for OPTIONS
  <a href="https://i.stack.imgur.com/FbbxZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FbbxZ.png" alt="The request and response details for OPTIONS"></a></p>
  
  <p>The request and response for GET which works properly
  <a href="https://i.stack.imgur.com/rAHWf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rAHWf.png" alt="Tee request and response for GET"></a> </p>