companionHeaders not being sent with AWS S3 Multipart Upload

I’m using the following configuration:

const uppy = new Uppy({
    autoProceed: true
}).use(AwsS3Multipart, {
    companionUrl: API_URL + `/company-files/${companyId}/upload`,
    companionHeaders: {
        Authorization: `Token ${token}`
    },
})

The only request headers sent are:

POST /company-files/7eaccf40-1fee-4e73-904f-c4a001775726/upload/s3/multipart HTTP/1.1
Host: localhost:8001
Connection: keep-alive
Content-Length: 142
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
Content-Type: application/json
Origin: http://localhost:8080
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/files
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

I really need to get the companionHeaders passed to my API so I can manage authentication.

[onhate]

I traced it down to this fetch operation that is not returning the access-control-allow-* headers on response, and that’s because cors response restricts the headers you can view to Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, and Pragma. so the logic that follows the prefetch and sets that allowedHeaders to the ones you sent on your response is never reached as it does not have access to allow-access-control-headers header.

if (response.headers.has('access-control-allow-headers')) {  /// THIS NEVER EVALUATES TO TRUE
          this.allowedHeaders = response.headers.get('access-control-allow-headers')
            .split(',').map((headerName) => headerName.trim().toLowerCase())
        }

https://github.com/transloadit/uppy/blob/master/packages/@uppy/companion-client/src/RequestClient.js#L99

https://developers.google.com/web/updates/2015/03/introduction-to-fetch#response_types

[onhate]

just an amend to @ifedapoolarewaju , in order to allow the client to read the Access-Control-Allow-Headers you need to add it to the list of Access-Control-Expose-Headers (if you have a custom implementation of the S3 Multipart server like I do)