Credentials flag is 'true', but the 'Access-Control-Allow-Credentials

Question

I am trying to connect to a ASP.NET Web-API Web Service from an AngularJS page and I am getting the following

Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials. Origin 'http://localhost:221' is therefore not allowed access.

       var cors = new EnableCorsAttribute("http://localhost:221", "*","GET,PUT,POST,DELETE");
       config.EnableCors(cors);

Using this AngularJS

        $http({
        method: 'GET',
        url: 'http://localhost:1980/api/investors/62632',
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
        withCredentials: true
        //    withCredentials: true,
    }).then(function onUserComplete(response) {
        // this callback will be called asynchronously
        // when the response is available
    }, function onError(response) {
        // called asynchronously if an error occurs
        // or server returns response with an error status.

After reading many articles I add this to the web.config

   <httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="http://localhost:221" />
  </customHeaders>
</httpProtocol>

and I get this error message

The 'Access-Control-Allow-Origin' header contains multiple values localhost:221, localhost:221, but only one is allowed. Origin localhost:221 is therefore not allowed access.

Which really doesn't make any sense as I have added it once and it doesn't find it but I add it to web.config and get an error saying its been added multiple times. I have read many articles and can't seem to find the right answer. I am using Google Chrome. Would be very grateful for help as I am pulling my hair out right now.

Answer 1

I came across this question while trying to hit a webapi on .net core from an angular2 app. I had to add AllowCredentials() to the cors configuration in my Configure method in the Startup.cs to look like the following.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    ...
    app.UseCors(builder =>
        builder
        .AllowCredentials()
        .WithOrigins("http://localhost:3000"));
    ...
}