Configuring CORS in IIS - Response to preflight request doesn't pass access control check: It does not have HTTP ok status

The Access-Control-Allow-Origin Header Explained – With a CORS Example Often times when calling an API, you may see an error in your console that looks like this:

 
Access to fetch at 'http://somesite.com' from origin 'http://yoursite.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value that is not equal to the supplied origin
 

Add following in

 
<system.webServer> 
 <httpProtocol> 
 <customHeaders> 
  <add name="Access-Control-Allow-Methods" value="*" /> 
  <add name="Access-Control-Allow-Origin" value="*" /> 
  <add name="Access-Control-Allow-Headers" value="*" /> 
 </customHeaders> 
 </system.webServer> 
  

After adding the above code in web.config, received the following error in response.

 
 .... Has been blocked by CORS policy: Response to preflight request
  doesn’t pass access control check: it does not have http ok status 
 

  You may still need to remove the default IIS OPTIONSVerbHandler, then add the OPTIONS verb to appropriate handler(s) to allow the requests to get to your api. then removing/commenting the following "OPTIONSVerbHandler" handler line //This line was not documented on Microsoft website >

 
  <!--<remove name="OPTIONSVerbHandler" />-->  

or changing it with the following:  

 
   <add name="OPTIONSVerbHandler" path="*" verb="OPTIONS"
  modules="ProtocolSupportModule" requireAccess="None"
  responseBufferLimit="4194304" />
 

// For me it worked without adding the following code in Web API. but for the safe side ...   Then in the Global.asax file, add the following method:

 
 protected void Application_BeginRequest(object sender, EventArgs e) 
 { 
  if (HttpContext.Current.Request.HttpMethod == "OPTIONS") 
  { 
    HttpContext.Current.Response.Flush(); 
  } 
 }