--cors not working

XMLHttpRequest cannot load http://127.0.0.1:8081/feeds.json. Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response

$ http-server --cors
Starting up http-server, serving ./
Available on:
  http://127.0.0.1:8081
  http://192.168.1.3:8081

Here are the headers:

Response Headers
access-control-allow-headers:Origin, X-Requested-With, Content-Type, Accept, Range
access-control-allow-origin:*
Connection:keep-alive
Date:Sun, 03 Sep 2017 07:51:28 GMT

Request Headers
view source
Accept:*/*
Accept-Encoding:gzip, deflate, br
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:authorization
Access-Control-Request-Method:GET

This is the OPTIONS request in chrome that is failing.

[ralyodio]

I had to pass --cors=Authorization

[danieladams456]

This is potentially unrelated to some of the more specific comments, but in general if you’re only testing in browser, the default caching of one hour can cause the non-cors response to be cached and fail to get the new cors response.