{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/CORS/issues/46","labels_url":"https://api.github.com/repos/aspnet/CORS/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/CORS/issues/46/comments","events_url":"https://api.github.com/repos/aspnet/CORS/issues/46/events","html_url":"https://github.com/aspnet/CORS/issues/46","id":112421774,"number":46,"title":"No CORS headers sent in case of error 500","user":{"login":"Flavien","id":296540,"avatar_url":"https://avatars.githubusercontent.com/u/296540?v=3","gravatar_id":"","url":"https://api.github.com/users/Flavien","html_url":"https://github.com/Flavien","followers_url":"https://api.github.com/users/Flavien/followers","following_url":"https://api.github.com/users/Flavien/following{/other_user}","gists_url":"https://api.github.com/users/Flavien/gists{/gist_id}","starred_url":"https://api.github.com/users/Flavien/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Flavien/subscriptions","organizations_url":"https://api.github.com/users/Flavien/orgs","repos_url":"https://api.github.com/users/Flavien/repos","events_url":"https://api.github.com/users/Flavien/events{/privacy}","received_events_url":"https://api.github.com/users/Flavien/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/CORS/labels/1%20-%20Ready","name":"1 - Ready","color":"CCCCCC"},{"url":"https://api.github.com/repos/aspnet/CORS/labels/investigate","name":"investigate","color":"bfe5bf"}],"state":"open","locked":false,"assignee":{"login":"kichalla","id":6559784,"avatar_url":"https://avatars.githubusercontent.com/u/6559784?v=3","gravatar_id":"","url":"https://api.github.com/users/kichalla","html_url":"https://github.com/kichalla","followers_url":"https://api.github.com/users/kichalla/followers","following_url":"https://api.github.com/users/kichalla/following{/other_user}","gists_url":"https://api.github.com/users/kichalla/gists{/gist_id}","starred_url":"https://api.github.com/users/kichalla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kichalla/subscriptions","organizations_url":"https://api.github.com/users/kichalla/orgs","repos_url":"https://api.github.com/users/kichalla/repos","events_url":"https://api.github.com/users/kichalla/events{/privacy}","received_events_url":"https://api.github.com/users/kichalla/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-10-20T17:41:49Z","updated_at":"2015-11-18T00:24:22Z","closed_at":null,"body":"When the controller throws an exception, which results in an error 500, the CORS headers are not sent.\r\n\r\nIs that by design? If so, why? If not, that's probably a bug."},"comment":{"url":"https://api.github.com/repos/aspnet/CORS/issues/comments/157553623","html_url":"https://github.com/aspnet/CORS/issues/46#issuecomment-157553623","issue_url":"https://api.github.com/repos/aspnet/CORS/issues/46","id":157553623,"user":{"login":"kichalla","id":6559784,"avatar_url":"https://avatars.githubusercontent.com/u/6559784?v=3","gravatar_id":"","url":"https://api.github.com/users/kichalla","html_url":"https://github.com/kichalla","followers_url":"https://api.github.com/users/kichalla/followers","following_url":"https://api.github.com/users/kichalla/following{/other_user}","gists_url":"https://api.github.com/users/kichalla/gists{/gist_id}","starred_url":"https://api.github.com/users/kichalla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kichalla/subscriptions","organizations_url":"https://api.github.com/users/kichalla/orgs","repos_url":"https://api.github.com/users/kichalla/repos","events_url":"https://api.github.com/users/kichalla/events{/privacy}","received_events_url":"https://api.github.com/users/kichalla/received_events","type":"User","site_admin":false},"created_at":"2015-11-18T00:24:22Z","updated_at":"2015-11-18T00:24:22Z","body":"This is by design due to the following reasons:\r\n- Even if we decide to support a feature for this scenario, sending full exception details across origins is probably not a good idea.\r\n- In the scenario where an exception is thrown in MVC (ex: controller's action), then you could write an exception filter to handle the exception and sanitize the outgoing message...for example, you could send out a json response with appropriate information and 500 status code."}}