Add authentication to OPTIONS request

Question

How can I add headers to the OPTIONS request made towards a cross-domain API?

The API I'm working against requires a JWT token set as Authorization header on all requests.

When I try to access to the API Angular first performs an OPTIONS request that doesn't care about my headers that I setup for the "real" request like this:

this._headers = new Headers({     'Content-Type': 'application/x-www-form-urlencoded',     'Authorization': 'Bearer my-token-here' });  return this._http             .post(AppConfig.apiUrl + 'auth/logout', params, {headers: this._headers})             ...             ... 

When no token is provided, the API returns HTTP status 401 and Angular thinks the OPTIONS request fails.

Answer 1

According to the CORS specification when a preflight request is performed user credentials are excluded.

(...) using the method OPTIONS, and with the following additional constraints:

• (...)
• Exclude the author request headers.
• Exclude user credentials.
• (...)

_{(emphasis is mine)}

With this in mind, the problem seems to be on the API side of things, which should be accepting OPTIONS requests without requiring authentication.