asp.net-mvc – CORS在使用OWIN认证的web api中不起作用

我已经配置了CORS支持所需的一切(我认为这样).这里我的配置

欧文启动班

public class Startup
    {
        public void Configuration(IAppBuilder app)
        {


            var config = new httpConfiguration
            {
                DependencyResolver = new StructureMapWebApiDependencyResolver(container)

            };


            WebApiConfig.Register(config);  // registering web api configuration
            app.UseCors(Microsoft.owin.Cors.CorsOptions.AllowAll);  // cors for owin token pipeline
            app.UseWebApi(config);
            ConfigureOAuth(app);


        }

        public void ConfigureOAuth(IAppBuilder app)
        {
            var oAuthAuthorizationServerOptions = new OAuthAuthorizationServerOptions()
            {

                AllowInsecurehttp = true,TokenEndpointPath = new PathString("/token"),AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),Provider = new SimpleAuthorizationServerProvider()
            };
            // Token Generation
            app.UseOAuthAuthorizationServer(oAuthAuthorizationServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

        }
    }

和我的webapi配置

public static class WebApiConfig
    {
        public static void Register(httpConfiguration config)
        {
            config.EnableCors();  // Corse support for Web api
            config.MaphttpAttributeRoutes(); // attribute based urls

            config.Routes.MaphttpRoute(
                name: "DefaultApi",routeTemplate: "api/{Controller}/{iD}",defaults: new { id = RouteParameter.optional }
            );

        }
    }

这里配置在web.config

<system.webserver>
 <httpProtocol>
      <customHeaders>
        <!-- Adding the following custom httpHeader will Help prevent CORS from stopping the request-->
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Methods" value="GET,POST,OPTIONS,PUT,deletE" />
      </customHeaders>
    </httpProtocol>
</system.webserver>

和我的请求标题从mozilla

Accept  application/json,text/plain,*/*
Accept-Encoding gzip,deflate
Accept-Language en-US,en;q=0.5
Content-Length  67
Content-Type    application/x-www-form-urlencoded; charset=UTF-8
Host    talenterp
Origin  http://192.168.1.11:85
Referer http://192.168.1.11:85/
User-Agent  Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0

应用程序的URL是

服务器应用程序(应支持CORS)

{http://talenterp}

令牌终点：

{http://talenterp/token}

客户端应用

{http://talentmvc:85}

注意：我已经添加

context.owinContext.Response.Headers.Add("Access-Control-Allow-Origin",new[] { "*" });

在我的AuthorizationServerProvider的GrantresourceownerCredentials()方法中

解决方法

public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {
        app.UseCors(Microsoft.owin.Cors.CorsOptions.AllowAll);

        ... etc