Enable CORS in Azure Mobile Services - OPTIONS not

I am creating .Net web services using Azure Mobile Services. The services themselves work fine, but I want to enable CORS.

My Global.asax contains:

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");
    if (HttpContext.Current.Request.HttpMethod != "OPTIONS") return;
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET,POST");
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers",
        "Authorization, Origin, Content-Type, Accept, X-Requested-With,x-zumo-application,x-zumo-installation-id");
    HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
    HttpContext.Current.Response.End();
}

My WebAPIConfig.cs contains:

    public static void Register()
    {
        ConfigOptions options = new ConfigOptions();
        HttpConfiguration config = ServiceConfig.Initialize(new ConfigBuilder(options));

        var cors = new EnableCorsAttribute("*", "*", "*","*");
        config.EnableCors(cors);

        config.Routes.MapHttpRoute("DefaultApiWithAction", "Api/{controller}/{action}");
    }

My request/response:

OPTIONS http://********.azure-mobile.net/API/MyLogin?username=username&amp;password=password&amp;email=testtest%40example.com&amp;_=140191793307 HTTP/1.1
Host: ********.azure-mobile.net
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: null
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type,x-zumo-application,x-zumo-installation-id
Connection: keep-alive
Cache-Control: max-age=0


HTTP/1.1 401 Unauthorized
Content-Length: 81
Content-Type: application/xml; charset=utf-8
Server: Microsoft-IIS/8.0
WWW-Authenticate: Basic realm=&quot;Service&quot;
X-Powered-By: ASP.NET
Set-Cookie:    ARRAffinity=50b9234b61ec5f663e817ec57c430ca7b921bbcd842719dfc2bdc27374adea87;Path=/;Domain=********.azure-mobile.net
Date: Wed, 04 Jun 2014 21:38:56 GMT

&lt;Error&gt;&lt;Message&gt;Authorization has been denied for this request.&lt;/Message&gt;&lt;/Error&gt;

There is a workaround for enabling CORS in Mobile Services here:

https://gist.github.com/HenrikFrystykNielsen/6c934be6c6c8fa9e4bc8

You don't need the Application_BeginRequest part -- requests/responses don't go through that code path -- they go through the OWIN pipeline. Good thing is that you only need the gist above to get going.

Hope this helps!

Henrik