Menu
How can I add headers to the OPTIONS request made towards a cross-domain API?
The API I'm working against requires a JWT token set as Authorization header on all requests.
When I try to access to the API Angular first performs an OPTIONS request that doesn't care about my headers that I setup for the "real" request like this:
this._headers = new Headers({ 'Content-Type': 'application/x-www-form-urlencoded', 'Authorization': 'Bearer my-token-here' }); return this._http .post(AppConfig.apiUrl + 'auth/logout', params, {headers: this._headers}) ... ... When no token is provided, the API returns HTTP status 401 and Angular thinks the OPTIONS request fails.
785
On the Authentication Method page, select the authentication option you want to use on your network. To select multiple methods that are attempted in order until one succeeds, click Advanced, click Customize, and then click Add to add methods to the list. Second authentication methods require Authenticated IP (AuthIP). Default.
To achieve this authentication, typically one provides authentication data through Authorization header or a custom header defined by server. Replace “user” and “pass” with your username and password. It will authenticate the request and return a response 200 or else it will return error 403.
Replace “user” and “pass” with your username and password. It will authenticate the request and return a response 200 or else it will return error 403. A common form of authentication for several web APIs is OAuth. The requests-oauthlib library allows Requests users to easily make OAuth 1 authenticated requests:
This chapter will discuss the types of authentication available in the Requests module. HTTP authentication is on the server-side asking for some authentication information like username, password when the client requests a URL. This is additional security for the request and the response being exchanged between the client and the server.
According to the CORS specification when a preflight request is performed user credentials are excluded.
(...) using the method OPTIONS, and with the following additional constraints:
- (...)
- Exclude the author request headers.
- Exclude user credentials.
- (...)
(emphasis is mine)
With this in mind, the problem seems to be on the API side of things, which should be accepting OPTIONS requests without requiring authentication.
87
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
