AngularJS访问控制允许原点

Question

I have Angularjs app connects to a server using API, and i'm using token authentication, when i use Postman to get the token, it works perfect, but when i'm use Angulajs with the same header and parameters i got error:400.

When i checked both requests using Fiddler, i found that the request from Angularjs is missing Access-Control-Allow-Origin: * header.

How to fix this?

Here is the service used to get the token:

AuthenticationApi.Login = function (loginData) {
    //POST's Object
    var data = "grant_type=password&username=" + loginData.userName + "&password=" + loginData.password;

    var deferred = $q.defer();

    //the data will be sent the data as string not JSON object.
    $http.post('http://localhost:53194/Token', data, { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } })
        .then(function (response) {
            console.log(response);
            localStorageService.set('authorizationData',
                {
                    token: response.access_token,
                    userName: loginData.userName
                });

            Authentication.isAuth = true;
            Authentication.userName = loginData.userName;
            console.log(Authentication);
        deferred.resolve(response);

    },
    function (err, status) {
        logout();
        deferred.reject(err);
    });

    return deferred.promise;

};

for the API server, i'v done CORS:

public void Configuration(IAppBuilder app)
{
    ConfigureOAuth(app); 
    HttpConfiguration config = new HttpConfiguration();
    WebApiConfig.Register(config);
    app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
    app.UseWebApi(config);
}

Answer 1

i found the problem and i fixed it. in the API server, i have this code:

var cors = new EnableCorsAttribute("*", "*", "*");
        cors.PreflightMaxAge = 60;
        config.EnableCors(cors);

The problem is in the PreflightMaxAge, i just commented it...It worked!!!

if the problem not solved, try to use IE or FireFox, don't use Chrome because it is not CORS enabled