Add authentication to OPTIONS request

Question

How can I add headers to the OPTIONS request made towards a cross-domain API?

The API I'm working against requires a JWT token set as Authorization header on all requests.

When I try to access to the API Angular first performs an OPTIONS request that doesn't care about my headers that I setup for the "real" request like this:

this._headers = new Headers({
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': 'Bearer my-token-here'
});

return this._http
            .post(AppConfig.apiUrl + 'auth/logout', params, {headers: this._headers})
            ...
            ...

When no token is provided, the API returns HTTP status 401 and Angular thinks the OPTIONS request fails.

Answer 1

According to the CORS specification when a preflight request is performed user credentials are excluded.

(...) using the method OPTIONS, and with the following additional constraints:

• (...)
• Exclude the author request headers.
• Exclude user credentials.
• (...)

_{(emphasis is mine)}

With this in mind, the problem seems to be on the API side of things, which should be accepting OPTIONS requests without requiring authentication.