Enabling CORS for .NET Web Api on Azure - azure

Question

I have both my web and api projects deployed to separate Azure webapps and am struggling with a CORS issue. When deployed locally everything works fine, but not once published to Azure.
I am using two different methods to enable CORS and neither seem to be solving my issue.
Potential Fixes:
In my web.config I add a customHeader for <add name="Access-Control-Allow-Origin" value="*" />
In the Register method of WebApiConfig.cs I call enableCors as var cors = new EnableCorsAttribute("*", "*", "*"); config.EnableCors(cors);
The scenarios, referencing the above two fixes, are as follows:
With neither #1 or #2 used every server call returns a no access-control-allow-origin error (expected)
With both #1 and #2 used I receive an error that I am enabling CORS twice with the same value (expected)
If I only use #1 I don't receive a CORS error but every API method returns a 405 not allowed error
If I only use #2 every api call returns a no access-control-allow-origin error
Question: How can I globally enable CORS for my .NET Web Api project hosted in Azure?
appstart and register code:
protected void Application_Start()
{
AreaRegistration.RegisterAllAreas();
GlobalConfiguration.Configure(WebApiConfig.Register);
FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
}
public static void Register(HttpConfiguration config)
{
// Enable CORS
// TODO, * below is debug only
var cors = new EnableCorsAttribute("*", "*", "*");
config.EnableCors(cors);
// Web API configuration and services
// Configure Web API to use only bearer token authentication.
config.SuppressDefaultHostAuthentication();
config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
// Web API routes
config.MapHttpAttributeRoutes();
config.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
}

Answer 1

I think this is the common issue with IIS default optionshandler. You have to update your Web.Config to disable defaults handlers. This is what I use for ASP.Net vnext hosted on Azure.
<system.webServer>
<modules>
<remove name="WebDAVModule" />
</modules>
<handlers>
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="WebDav" />
<remove name="OPTIONSVerbHandler" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>

Answer 2

I found that adding the Allow headers to web.config was the simplest way to get things working for me. Note you can't use both methods, you must choose one or the other.
I believe the solution to your 405 Not Allowed error is that you also need to include a line like this in web.config:
<add name="Access-Control-Allow-Headers" value="Authorization, Origin, Content-Type "/>
If you are still getting that error, you may need to include additional values from this list:
<add name="Access-Control-Allow-Headers" value="Access-Control-Allow-Headers, Authorization, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers" />