Angular2 + Windows Authentication

Gobal.asax.cs

protected void Application_BeginRequest()
{
    if (Request.Headers.AllKeys.Contains("Origin") && Request.HttpMethod == "OPTIONS")
    {
        Response.Flush();
    }
}

service.ts

import { Injectable } from '@angular/core';
import { Http } from '@angular/http';

@Injectable()
export class MyService {
    private serviceUrl: string = 'http://localhost:3620';

    constructor(private http: Http) { }

    get() {
        // need to have { withCredentials: true }
        return this.http.get(`${this.serviceUrl}/api/values`, { withCredentials: true })
            .toPromise()
            .then(r => r.json())
            .catch(r => console.log(r));
    }
}

web.config

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Headers" value="accept,Content-Type, Authorization" />
        <add name="Access-Control-Allow-Methods" value="GET,POST,OPTIONS" />
        <add name="Access-Control-Allow-Credentials" value="true"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

WebApiConfig.cs

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        // Web API configuration and services

        // Web API routes
        config.MapHttpAttributeRoutes();

        var corsAttr = new EnableCorsAttribute("*", "*", "*");
        corsAttr.SupportsCredentials = true;
        
        // Enable CORS Globally
        config.EnableCors(corsAttr);

        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
    }
}