Q:

Refused to get unsafe header "WWW-Authenticate" in web api

So I have two asp .net web apis, which are identical in configuration. I am getting the token from identity server (in house implementation) and passing it along. Have enabled cors in both identically. One of them works fine, other is throwing below error - 
Refused to get unsafe header "WWW-Authenticate"
I am clueless. Below is my web api configuration - 
            // Web API routes
        config.MapHttpAttributeRoutes();

        config.Formatters.Remove(config.Formatters.XmlFormatter);

        config.Routes.MapHttpRoute("DefaultApi", "api/{controller}/{id}", new {id = RouteParameter.Optional});

        config.Formatters.JsonFormatter.SupportedMediaTypes.Add(new MediaTypeHeaderValue("text/html"));

        config.EnableCors(new EnableCorsAttribute(WebConfigurationManager.AppSettings["cors"], "accept, authorization", "GET", "WWW-Authenticate"));

Will appreciate any help or clues in resolving this.

A:

turns out - this was a token validation issue and hence authorization was failing.
Startup.cs, where I had token validation code was not firing because of a missing nuget. Everything works fine after installing the missing library.

