Getting CORS to work with Web API and SignalR
<p>Been having difficult getting SignalR and CORS working with an ASP.NET Web API v2 using OWIN authentication.</p>

<p>It seems as though I can can either CORS working with SignalR or the Web API but not both. I am configuring CORS via code as trying to add headers via the web.config did not work for me. Below is the Configuration method from Startup.cs</p>

<pre><code>    public void Configuration(IAppBuilder app)
    {
        app.UseCors(CorsOptions.AllowAll);
        HttpConfiguration httpConfig = new HttpConfiguration();
        ConfigureOAuthTokenGeneration(app);
        ConfigureOAuthTokenConsumption(app);
        ConfigureWebApi(httpConfig);
        app.UseWebApi(httpConfig);
    }
</code></pre>

<p>With the above configuration <strong>the Web Api works</strong>. I am able to authenticate and call API methods from the client. However, I get an error when the client attempts to reach the SignalR scripts. Notice the CORS error <code>No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is therefore not allowed access.</code> in the second error message.</p>

<pre><code>http://localhost:49834/signalr/negotiate?clientProtocol=1.5&amp;connectionData=%5B%7B%22name%22%3A%22loginhub%22%7D%5D&amp;_=1461093918311 Failed to load resource: the server responded with a status of 404 (Not Found)

XMLHttpRequest cannot load http://localhost:49834/signalr/negotiate?clientProtocol=1.5&amp;connectionData=%5B%7B%22name%22%3A%22myhub%22%7D%5D&amp;_=1461093918311. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is therefore not allowed access. The response had HTTP status code 404.
</code></pre>

<p>This is confusing ... <strong>Why doesn't the CORS configuration also cover the path to the SignalR scripts that are located at <code>http://localhost:8080/signalr/</code>?</strong></p>

<p>So after searching SO and Googling for a while I came across a <a href="https://stackoverflow.com/questions/24034259/signalr-cors-on-azure-mobile-services-web-api/24050581#24050581">SO post</a> that dealt specifically with SignalR. The answer suggested added in the following to the <code>Configuration</code> method. After that SignalR worked!</p>

<pre><code>public void Configuration(IAppBuilder app)
{
    app.UseCors(CorsOptions.AllowAll);

    // ****** Start added code ******
    //Branch the pipeline here for requests that start with "/signalr"
    app.Map("/signalr", map =&gt;
    {
        // Setup the CORS middleware to run before SignalR.
        // By default this will allow all origins. You can 
        // configure the set of origins and/or http verbs by
        // providing a cors options with a different policy.
        map.UseCors(CorsOptions.AllowAll);
        var hubConfiguration = new HubConfiguration
        {
            // You can enable JSONP by uncommenting line below.
            // JSONP requests are insecure but some older browsers (and some
            // versions of IE) require JSONP to work cross domain
            // EnableJSONP = true;
        };
        // Run the SignalR pipeline. We're not using MapSignalR
        // since this branch already runs under the "/signalr"
        // path.
        map.RunSignalR(hubConfiguration);
    });
    // ****** End added code *******

    HttpConfiguration httpConfig = new HttpConfiguration();
    ConfigureOAuthTokenGeneration(app);
    ConfigureOAuthTokenConsumption(app);
    ConfigureWebApi(httpConfig);
    app.UseWebApi(httpConfig);
}
</code></pre>

<p><strong>Why is this second section to the configuration needed?</strong> in order for SignalR to work? Shouldn't have <code>app.UseCors(CorsOptions.AllowAll);</code> worked?</p>