Angular如何在HTTP请求中发送身份验证令牌时不发送OPTION

Question

Having an issue with CORS, trying to do a GET request with Authorization token but having an issue with OPTIONS. Wondering how to not send OPTIONS when requesting GET to another server?

$http({
        url: request_data.url,
        type: request_data.method,
        withCredentials: true,
        headers: {
            'Authorization': localStorage.getItem('Auth'),
            'Content-Type': 'application/json; charset=utf-8'
        },
        crossDomain: true
    }).then(function(response) {
        //process your data here
        vm.prodData = response.data;
        console.log(response.data);
    });

I can't send a request because the CORS issue, probably due to the header Authorization part.

Answer 1

You can't.

Authorization headers are not "safe", so you can't include them in a cross origin request without permission.

The preflight OPTIONS request is there to ask for permission.

You are doing something unusual that is a potential risk, so you have to change the server you are making the request to so it will tell the browser that it is OK to make the request.

Answer 2

Is far as i know when youre trying a CORS request it will always send an OPTIONS request first to check if youre allowed to make requests, you have to deal with that on server side, for instance in php i do the following:

if($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    header( "HTTP/1.1 200 OK" );
    exit();
}

that way if the client send an OPTIONS request it will automaticly send an 200 OK response and then it will wait for the correct request (GET, POST, etc)