Nice article, though it doesn't cover CORS with NTLM/Kerberos auth (ie. .NET on windows).
To my mind this is the most baffling aspect here, as preflight requests shouldn't carry an auth token (according to the spec), however IIS is an all-or-nothing auth which will thus reject the preflight request, unless it is specifically handled.
Additionally, there are different ways to handle preflighting for owin and aspnetcore vs .NET framework (IIS hosting), and these methods also change depending on the technology - MVC, WebAPI, OData.
Lastly, all of the above should be using xhr.withCredentials = true; on the client (javascript) side.
Note that this is not present for breeze-odata4 (I'm patching when I have time) but is present on Jaydata (though it's a shame Jaydata doesn't play nicely with webpack, only browserify).
To my mind this is the most baffling aspect here, as preflight requests shouldn't carry an auth token (according to the spec), however IIS is an all-or-nothing auth which will thus reject the preflight request, unless it is specifically handled.
Additionally, there are different ways to handle preflighting for owin and aspnetcore vs .NET framework (IIS hosting), and these methods also change depending on the technology - MVC, WebAPI, OData.
[edit] Hit return early:
MVC (pure) requests can be handled in the web.config to set custom headers. WebAPI uses annotations on the controllers. See https://stackoverflow.com/questions/29970793/enabling-cors-t...
OData follows a different path through, so the above won't work. You would need to modify Application_BeginRequest() See https://stackoverflow.com/questions/31459416/how-to-enable-c...
The above is all for .NET framework (IIS host). For OWIN you need to modify HttpListener as per https://stackoverflow.com/questions/42104716/owin-preflight-...
For aspnetcore the pipeline again changes: https://weblog.west-wind.com/posts/2016/Sep/26/ASPNET-Core-a...
Lastly, all of the above should be using xhr.withCredentials = true; on the client (javascript) side.
Note that this is not present for breeze-odata4 (I'm patching when I have time) but is present on Jaydata (though it's a shame Jaydata doesn't play nicely with webpack, only browserify).