在AngularJS应用中使用$ http从发布请求中删除标头字段

Question

In an AngularJS app I'm posting a form to a payment gateway. I have a header field called "Authorization" to pass my session token to the backend API.

When trying to make a request to the payment gateway I get the following error:

XMLHttpRequest cannot load https://transact.nab.com.au/test/directpostv2/authorise . Request header field Authorization is not allowed by Access-Control-Allow-Headers.

When making the same request using Postman everything works fine, with a 200 status code.

I've created a plunkr for a quick demo which also gets a 200 status http://plnkr.co/edit/8Ts6s0VDTTUVVC9dbCJC

$http({
    method: 'POST',
    url: authoriseURL,
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
    },
    data: nabPaymentData
}).
success(function (response, status, headers) {
    alert('Success:' + response + ' status:' + status + ' headers:' + headers);
}).
error(function (err, status, headers) {
    alert('Error:' + err + ' status:' + status + ' headers:' + headers);
});

Is there a way to strip header fields for one single post request?

Answer 1

As my comment above you can use interceptor to remove auth header only for request to payment gateway. The solution will be like this. First we define interceptor using factory. Later we push the interceptor in angular config.

app.factory('myInterceptor', ['$log', function($log) {
    return {
    // optional method
    'request': function(config) {
      $log.debug(config.url);
      // if request to payment gateway, delete the auth header
      if(config.url.indexOf('https://transact.nab.com.au') > -1) {
        $log.debug('before deleting auth header');
        $log.debug(config.headers);
        delete config.headers.Authorization;
        $log.debug('after deleting auth header');
        $log.debug(config.headers);
      }
      $log.debug(config.url);
      $log.debug(config.headers);
      // do something on success
      return config;
    },


  };
}]);

app.config(['$httpProvider', function($httpProvider) {
    $httpProvider.interceptors.push('myInterceptor');
}]);

Answer 2

You can remove the Authorization field for just that POST request by setting it to undefined :

$http({
  method: 'POST',
  url: authoriseURL,
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': undefined
  },
  data: nabPaymentData
});