general idea of fix for https://github.com/aspnet/AspNetWebStack/issues/147

src/System.Web.Cors/CorsPolicy.cs

@@ -85,6 +85,11 @@ namespace System.Web.Cors
         /// </summary>
         public bool SupportsCredentials { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether upstream exceptions should be rethrown.
+        /// </summary>
+        public bool RethrowExceptions { get; set; }
+
         /// <summary>
         /// Returns a <see cref="System.String" /> that represents this instance.
         /// </summary>

src/System.Web.Http.Cors/CorsMessageHandler.cs

@@ -47,6 +47,7 @@ namespace System.Web.Http.Cors
             CorsRequestContext corsRequestContext = request.GetCorsRequestContext();
             if (corsRequestContext != null)
             {
+                CorsPolicy corsPolicy = await GetCorsPolicyAsync(request, cancellationToken);
                 try
                 {
                     if (corsRequestContext.IsPreflight)
@@ -60,6 +61,9 @@ namespace System.Web.Http.Cors
                 }
                 catch (Exception exception)
                 {
+                    if (corsPolicy.RethrowExceptions)
+                        throw;
+
                     return HandleException(request, exception);
                 }
             }