Authorization breaks CORS support

[diachedelic]

It seems GCDWebServer, when configured to use Basic auth, requires the Authorization header on preflight (OPTIONS) requests. However, the spec states that browsers are not to send the Authorization header for preflight, so unfortunately I cannot use both CORS and authorization, as the preflight requests are rejected with 401 Unauthorized.

Refer to the CORS spec where it says preflight requests should "Exclude user credentials".

[swisspol]

Good catch, thanks for reporting.

[fabiosoft]

Still not solved? I have the same issue... the preflight maybe should return 204 status code to be able to support web browsers