Add authentication to OPTIONS request

Question

How can I add headers to the OPTIONS request made towards a cross-domain API?

The API I'm working against requires a JWT token set as Authorization header on all requests.

When I try to access to the API Angular first performs an OPTIONS request that doesn't care about my headers that I setup for the "real" request like this:

this._headers = new Headers({
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': 'Bearer my-token-here'
});

return this._http
            .post(AppConfig.apiUrl + 'auth/logout', params, {headers: this._headers})
            ...
            ...

When no token is provided, the API returns HTTP status 401 and Angular thinks the OPTIONS request fails.

Solution

According to the CORS specification when a preflight request is performed user credentials are excluded.

(...) using the method OPTIONS, and with the following additional constraints:

• (...)
• Exclude the author request headers.
• Exclude user credentials.
• (...)

_{(emphasis is mine)}

With this in mind, the problem seems to be on the API side of things, which should be accepting OPTIONS requests without requiring authentication.

Comments

[haz]

The source is a living standard and no longer has the quoted text. Is this Answer still correct in 2021?

[João Angelo]

At the present time, in section 3.2.5 (fetch.spec.whatwg.org/#cors-protocol-and-credentials) it's mentioned: "Note that even so, a CORS-preflight request never includes credentials."

[haz]

Thanks. I was searching for "user credentials" and was very confused. And also am not great at reading english, apparently.