Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response. (nginx)

Question

https://example.com fire ajax pre-request(beforeSend) to https://api.example.com (nginx)

$.ajax({
    method: "POST",
    url: 'https://api.example.com',
    xhrFields: {withCredentials: true},
    data: {...},
    success: function(msg) {...},
    beforeSend: function(request){
        var token = 'xxxxxx';
        request.setRequestHeader('Authorization', 'Bearer ' + token);
    },
    complete: function(msg) {},
    error: function(xhr, ajaxOptions, thrownError) {}
});

Chrome console return error message

XMLHttpRequest cannot load https://api.example.com/auth. Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response.

Samuel Lui · Accepted Answer · 2017-05-21 03:58:46Z

5

location / {
    if ($request_method = OPTIONS ) {
        add_header Access-Control-Allow-Origin "https://example.com";
        add_header Access-Control-Allow-Methods "GET, OPTIONS";
        add_header Access-Control-Allow-Headers "Authorization";
        add_header Access-Control-Allow-Credentials "true";
        add_header Content-Length 0;
        add_header Content-Type text/plain;
        return 200;
    }
}

answered May 21, 2017 at 3:58

Samuel Lui

1691 gold badge2 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jaromanda X Over a year ago

Is this a solution? Just wondering because there's no explanation of what this is or where this code belongs

Libby Lebyane Over a year ago

the solution posted above works for me, this needs to be added in /etc/nginx/sites-available/default in the suspicious server.

u-ways · Accepted Answer · 2018-09-12 14:13:26Z

3

I added this to Nginx and it worked:

add_header Access-Control-Allow-Headers "Authorization";

For the error:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://localhost:3000' is therefore not allowed access.

I added this to Nginx:

add_header Access-Control-Allow-Origin *;

edited Sep 12, 2018 at 14:13

u-ways

8,3526 gold badges41 silver badges56 bronze badges

answered Sep 12, 2018 at 13:16

theeam

312 bronze badges

Collectives™ on Stack Overflow

Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response. (nginx)

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related