IIS is executing request even if CORS is disabled

Question

I have two MVC ASP.NET applications. I'm trying to make ajax POST request from one app to another. By default CORS should have been disabled, and I'm getting alert in console:

XMLHttpRequest cannot load http://localhost:2211/Home/Form . No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ' http://localhost:2282 ' is therefore not allowed access.

So everything should be right. But...

I realized that this request executed that specific action on http://localhost:2211 . How is that possible? Why that request was executed even though CORS had been disabled?

Answer 1

The request to http://localhost:2211/Home/Form was made, however the response from that request did not contain an Access-Control-Allow-Origin header which results in the browser declining to process the response for you.

Until the server responds to the request that's been made to it, providing the header, the browser won't know if the request was/is permitted or not, ie the onus is on the browser to react to the Access-Control-Allow-Origin header, rather than the server.

You may even see different behaviours here depending on the browser you're using as, for example:

Internet Explorer does not consider the port when comparing origins.

docs.microsoft.com > What is "same origin"