Axios is sending the Authorization header in preflight requests

Summary

Axios is sending the Authorization header in preflight requests, which it shouldn’t

There should be an option to enable/disable this

The error is Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response.

This doesn’t work (the jquery ajax alternative works)

    HTTP.get("http://mysite.com/",{
      responseType: 'text',
      withCredentials: true,
      auth: {
        username: "abcd",
        password: "1234"
      }
    })
    .then(response => {});

This works (after entering the username and password in the pop up)

    HTTP.get("http://mysite.com/",{
      responseType: 'text',
      withCredentials: true,
      /*auth: {
        username: "abcd",
        password: "1234"
      }*/
    })
    .then(response => {});

Context

• axios version: 0.18.0

[chinesedfan]

CORS problem, instead of an axios issues.

[Maksio]

I decide this issue with setting server’s answer $response->headers->add('Access-Control-Allow-Headers', 'Authorization, Content-Type');