To enable cors on IIS - all sites on the machine:

Add a or change web.config on the root web site (Default Web site)

<?xml version="1.0" encoding="utf-8"?>  
<configuration>    
  <system.webServer>      
    <httpProtocol>        
      <customHeaders>          
        <add name="Access-Control-Allow-Origin" value="*" />        
      </customHeaders>      
    </httpProtocol>    
   </system.webServer>  
 </configuration>

To do this on App level - change Web.config

Good links: https://www.w3.org/wiki/CORS_Enabled