ajax call, setrequestheader

We overcame CORS issues by updating our Web API. We use IIS, so originally we were adding necessary headers in the IIS Manager directly, but then moved them to a centralized place to simplify deployment.

We made changes to the Web API's Global.asax file, as following:

        protected void Application_BeginRequest(object sender, EventArgs e)

        {

            ...

            EnableCrossDomainAjaxCall();

        }

        private void EnableCrossDomainAjaxCall()

        {

            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");     //To make sure CORS calls are not rejected

            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept, ClientID, ResourceID, UserID, Token");     //To process standard and our custom headers

            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD, TRACE");     //To allow standard methods

            //This is to cache the calls (relevant for OPTIONS) for some time - HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");

            if (HttpContext.Current.Request.HttpMethod == "OPTIONS")

            {

                HttpContext.Current.Response.End();     //We need that to handle the preflight (OPTIONS) calls correctly, the preflight call is made automatically before, let's say, GET or POST in line with CORS protocol

            }

        }