preflight request in enabled CORS ASP.NET Web API 2 application with windows authentication
<p>I have a Web API application which is used in our intranet. We also used windows authentication for define a limitation on who can access to these Web APIs in the Intranet.</p>

<p>In addition, We have an angularJS application. It uses the WEB API application. the domain of these applications are different. Hence we used CORS.</p>

<p>for enabling CORS, we used Microsoft CORS Nuget packages.</p>

<pre><code>public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {

        config.MapHttpAttributeRoutes();

        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );

        var cors = new EnableCorsAttribute("*", "*", "*") { SupportsCredentials = true };
        config.EnableCors(cors);
    }
}
</code></pre>

<p>I have two WEB APIs ( GET and POST). When my UI is loaded the GET API is called. When user click on save button the POST API is called. </p>

<pre><code>[RoutePrefix("api/call")]
[Authorize]
public class CallController : TecApiController
{
    [HttpGet]
    [Route("GetInfo")]
    public IHttpActionResult GetCallInfo(int Id)
    {
       //return Model
    }

    [HttpPost]
    [Route("saveInfo")]
    public IHttpActionResult SetUncompleteCallToDismissed([FromBody] Model model)
    {
        // Save Model
    }
}
</code></pre>

<p>my AngularJS service for calling API is like following </p>

<pre><code>$http.get(apiEndPoint + 'GetInfo/' + Id, { withCredentials: true })
            .then(function (response) { return response.data; },    handleError);

$http.post(apiEndPoint + 'saveInfo/', model, { withCredentials: true })
            .then(function (response) { return response.data; }, handleError);
</code></pre>

<p>My problem is GET method is work well. But when I click on the post I got following error in my browser console:</p>

<blockquote>
  <p>XMLHttpRequest cannot load
  <a href="http://localhost:35059/api/call/saveInfo" rel="nofollow noreferrer">http://localhost:35059/api/call/saveInfo</a>. Response to
  preflight request doesn't pass access control check: No
  'Access-Control-Allow-Origin' header is present on the requested
  resource. Origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' is therefore not allowed
  access. The response had HTTP status code 401.</p>
</blockquote>

<p>The most wired things which happened here is when I run Fiddler for debugging the request, everything becomes fine. </p>

<p>please advice me how I can fixed it.</p>