HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Origin", "*");

<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Headers" value="Content-Type" />
<add name="Access-Control-Allow-Methods" value="*" />
</customHeaders>
</httpProtocol>
</system.webServer>

  /// <summary>
  /// 跨域
  /// </summary>
  public class Cores:ActionFilterAttribute
  {
    public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
    {
      base.OnActionExecuted(actionExecutedContext);
      actionExecutedContext.Response.Headers.Add("Access-Control-Allow-Origin","*");
    }
  }

  public static class WebApiConfig
  {
    public static void Register(HttpConfiguration config)
    {
      // Web API 配置和服务
      // 将 Web API 配置为仅使用不记名令牌身份验证。
      config.SuppressDefaultHostAuthentication();
      config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
      // Web API 路由
      config.MapHttpAttributeRoutes();
      config.Filters.Add(new Cores());
      config.Routes.MapHttpRoute(
        name: "DefaultApi",
        routeTemplate: "api/{controller}/{id}",
        defaults: new { id = RouteParameter.Optional }
      );
    }
  }