To enable cors on IIS - all sites on the machine:

Add a or change web.config on the root web site (Default Web site)

<?xml version="1.0" encoding="utf-8"?>  
<configuration>    
  <system.webServer>      
    <httpProtocol>        
      <customHeaders>          
        <add name="Access-Control-Allow-Origin" value="*" />        
      </customHeaders>      
    </httpProtocol>    
   </system.webServer>  
 </configuration>

To do this on App level - change Web.config in the same way - but beware that web-config is part of installation and will be replaced on update.

Good links: https://www.w3.org/wiki/CORS_Enabled https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api