To enable cors on IIS - all sites on the machine:

Add a or change web.config on the root web site (Default Web site)

<?xml version="1.0" encoding="utf-8"?>  
<configuration>    
  <system.webServer>      
    <cors enabled="true" failUnlistedOrigins="true">
      <add origin="*"/>
      <add origin="https://www.test-cors.org" allowCredentials="true" >
        <allowHeaders allowAllRequestedHeaders="true"/>
      </add>
    </cors>
  </system.webServer>  
</configuration>

To do this on App level - change Web.config in the same way - but beware that web-config is part of installation and will be replaced on update.

Good links:

• Details from the IIS team on details on how to configure CORS using XML (like above): https://blogs.iis.net/iisteam/getting-started-with-the-iis-cors-module

• https://www.w3.org/wiki/CORS_Enabled

• https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Testing that CORS is active, you can use for example this online tool. Just enter the root URL of your site in "Remote URL"

https://www.test-cors.org/