<configuration>
...
<system.webServer>
...
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Methods" value="DELETE, GET, HEAD, OPTIONS, POST, PUT" />
<add name="Access-Control-Allow-Headers" value="Accept, Authorization, Content-Type, Origin, X-Requested-With" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>