asp.net mvc 4 - CORS Headers appended to HTTP Response not Sent to Browser -

i writing directly request headers in asp.net mvc via httpcontext.current object , yet these headers not being sent browser... idea cause this? headers if add them via web.config. not work me need allow multiple domains access-control-allow-origin.

i attempted write headers directly httpcontext.current using code.

context.response.appendheader("access-control-allow-origin", origin); context.response.cache.setcacheability(httpcacheability.nocache); context.response.contenttype = "text/plain"; context.response.write("hello world " + datetime.now.tostring()); 

i hello world not headers.

i have attempted use thinktecture.identitymodel.http.cors.webapi same results, nothing. have checked rechecked code sure conforms tutorial]1. have configured headers in web.config , attempted via thinktecture headers when access-control-allow-origin in web.config still error in chrome/ff. seems headers being sent on options request not certain.

accept:*/* accept-charset:iso-8859-1,utf-8;q=0.7,*;q=0.3 accept-encoding:gzip,deflate,sdch accept-language:en-us,en;q=0.8,ga;q=0.6,pt-br;q=0.4,pt;q=0.2 access-control-request-headers:accept, origin, content-type access-control-request-method:get authorization:negotiate redacted cache-control:max-age=0 connection:keep-alive host:bpapi.domain.com origin:http://dev-02 referer:http://dev-02/_layouts/par/newparitem.aspx user-agent:mozilla/5.0 (windows nt 6.1; wow64) applewebkit/537.31 (khtml, gecko) chrome/26.0.1410.43 safari/537.31   http/1.1 200 ok server: microsoft-iis/7.5 persistent-auth: false x-powered-by: asp.net access-control-allow-origin: http://dev-02 access-control-allow-headers: origin, x-requested-with, content-type, accept www-authenticate: negotiate redacted date: sat, 06 apr 2013 00:35:31 gmt content-length: 0 

here web.config pastebin not clutter question. webdav not installed.

public class corsconfig {     public static void registercors(httpconfiguration httpconfig)     {         webapicorsconfiguration corsconfig = new webapicorsconfiguration();          corsconfig.registerglobal(httpconfig);          corsconfig                 .forresources(new string[] { "industries", "projects" })                 .fororigins(new string[] { "http://dev-01", "http://dev-02" })                 .allowall();     } } 

here thinktecture code:

    protected void application_start()     {         arearegistration.registerallareas();          webapiconfig.register(globalconfiguration.configuration);         filterconfig.registerglobalfilters(globalfilters.filters);         routeconfig.registerroutes(routetable.routes);         bundleconfig.registerbundles(bundletable.bundles);         //corsconfig.registercors(globalconfiguration.configuration);         registercors(mvccorsconfiguration.configuration);     }     private void registercors(mvccorsconfiguration corsconfig)     {         corsconfig             .forresources(new string[] {"industries", "projects" })             .fororigins(new string[] { "http://dev-01", "http://dev-02" })             .allowall();     } 

update 2013/04/09: neither context.response.appendheader(...) nor context.response.addheader(...) have effect. chrome , ff seem ok if jsonp regardless of allow origin header project @ least works. have tried <remove name="optionsverbhandler"/> no success. deploying mvc app new server see if localized specific machine.

may be, troubles due optionsverbhandler. see link details:
http://eugeneagafonov.com/post/38312919044/iis-options-cors-aspnet-webapi-en