Authorization breaks CORS support
Opened this issue · 2 comments
diachedelic commented
It seems GCDWebServer, when configured to use Basic auth, requires the Authorization header on preflight (OPTIONS) requests. However, the spec states that browsers are not to send the Authorization header for preflight, so unfortunately I cannot use both CORS and authorization, as the preflight requests are rejected with 401 Unauthorized.
Refer to the CORS spec where it says preflight requests should "Exclude user credentials".
swisspol commented
Good catch, thanks for reporting.
fabiosoft commented
Still not solved? I have the same issue... the preflight maybe should return 204 status code to be able to support web browsers