One query I have concerning CORS requests that include the HTTP Authorization header:
I've noticed that the web browser doesn't seem to send the Authorization header with POST requests, is there a workaround for this?
Below is the Angular code I am using:
var app = angular.module('app', [])
.config(['$httpProvider', function($httpProvider) {
$httpProvider.defaults.useXDomain = true;
delete $httpProvider.defaults.headers.common['X-Requested-With'];
}]);
app.controller('ctrl', function ($scope, $http) {
$scope.insert = function () {
$http.post('http://my.api.com/Insert',
{
headers: {
'Authorization': 'Basic dGVzdDp0ZXN0',
'Content-Type': 'application/x-www-form-urlencoded'
},
data: {
'Code': 'test data'
},
withCredentials: true
});
};
});
On the server side, I have the following in my web.config file:
<httpProtocol >
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Headers" value="Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With" />
<add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" />
<add name="Access-Control-Allow-Credentials" value="true" />
</customHeaders>
</httpProtocol>