What does exactly is the Microsoft.Owin.Cors middleware when used with ASP.NET Web Api 2.0? -

i have asp.net web api 2.0 project token authentication , done following article:

token based authentication using asp.net web api 2, owin, , identity, bit of technology

but struggling understand line of code in startup.cs does:

app.usecors(microsoft.owin.cors.corsoptions.allowall); 

this not make web api add access-control-allow-origin header api responses, in other words not enable cors in web api (still trying understand how way). not add bearer token authentication server response. have have code oauthauthorizationserverprovider:

public override task grantresourceownercredentials(oauthgrantresourceownercredentialscontext context)     {         context.owincontext.response.headers.add("access-control-allow-origin", new[] { "*" });  

to enable cors on token provider end point responses.

so use of microsoft.owin.cors middleware anyway? because everywhere read web api 2.0 , cors line of code

app.usecors(microsoft.owin.cors.corsoptions.allowall); 

comes up:

thanks following tutorial.

this loc app.usecors(microsoft.owin.cors.corsoptions.allowall); used enable cors api (any controller inheriting apicontroller).

but authz server , end point /token make no affect why i've add context.owincontext.response.headers.add("access-control-allow-origin", new[] { "*" }); end point not part api , doesn't inherit apicontroller class.

hope answers question.