asp.net - CORS POST Requests not working - OPTIONS (Bad Request) - The origin is not allowed -

i'm having lot of trouble getting cross domain post request hit api controller in latest beta 2 release.

chrome (and other browsers) spit out:

options http://api.hybridwebapp.com/api/values 400 (bad request) post http://api.hybridwebapp.com/api/values 404 (not found)  

it may related this issue have applied workaround , several other fixes such web.config additions here

i've been banging head while created solution reproduce problem exactly.

load web app there 2 buttons 1 1 post , response appear next button. works. cannot post return successfully.

i'm able hint @ cause fiddler makes no sense because if @ response include domain in access-controll-allow-origin header:

there folder in solution called "configurationscreenshots" few screenshots of iis configuration (website bindings) , project properties configurations make easy possible me :)

edit: don't forget add entry host file (%systemroot%\system32\drivers\etc):

 127.0.0.1     hybridwebapp.com  api.hybridwebapp.com 

**status: ** seems browsers chrome allow me proceed post regardless of error message in options response (while others firefox don't). don't consider solved.

look @ fidler screenshots of options request has

access-control-allow-origin: http://hybridwebapp.com

and yet error:

the origin http://hybridwebapp.com not allowed

that contradictory it's if it's ignoring header.

ok got past this. has got strangest issue i've ever encountered. here's how "solve" it:

1. continue on life usual until suddenly out of no where options requests domain begin returning 200 ok (instead of 400 bad request) , post never happens (or @ least seems doesn't because browser swallows it)
2. realize fiddler's options response mysteriously contains duplicates "access-control-allow-xxx".
3. try removing following statement web.config though remember trying fix previous issue , not working:

remove this:

    <httpprotocol>        <customheaders>          <remove name="x-powered-by" />          <add name="access-control-allow-origin" value="http://mydomain.com" />          <add name="access-control-allow-headers" value="accept, content-type, origin" />          <add name="access-control-allow-methods" value="get, put, post, delete, options" />        </customheaders>     </httpprotocol> 

because have this:

 var enablecorsattribute = new enablecorsattribute("http://mydomain.com",                                                    "origin, content-type, accept",                                                    "get, put, post, delete, options");         config.enablecors(enablecorsattribute); 

moral: need one.