The answer to your question is simple: Yes, you can.
The only thing that matters is that you apply your settings to the same HttpConfiguration instance, which then goes on to the app.UseWebApi() extension method.
WebApiConfig.cs is the only template file created by the default web API template to separate the web API configuration from other configuration files. If you plan to use only Owin, you can simply ignore it.
[Change] Sample code inside the Startup.cs Configuration method:
var config = new HttpConfiguration(); var cors = new EnableCorsAttribute("http://localhost:5901", "*", "*"); config.EnableCors(cors); app.UseWebApi(config);
Responding to comments if you are using app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll); , you set the CORS headers at a higher level and then the Web API, and you wonβt need to use EnableCorsAttribute at all. The main difference in your case is that with CorsAttribute you will have a fine graded configuration above the CORS header (for example, you can set a different CORS header for each Action method).
Remember to put app.UseCors in front of any other Owin software in your Configuration method.
source share