Chrome v37/38 CORS failing (again) with 401 for OPTIONS pre-flight requests

by

@Cornel Masson, did you solve the problem? I do not understand why your server is asking you to authenticate the OPTIONS request, but I am facing this same issue against a SAP NetWeaver server. I have read the whole CORS specification (I recommend) so I can clarify you some of your doubts.

About your sentence

In the Angular app I explicitly set the following request headers. AFAIK this setting for withCredentials should ensure that credentials are sent even for OPTIONS requests:

  • According to the CORS specification when a user agent (thus, a browser) preflights a request (requests with OPTIONS HTTP method), it MUST exclude the user credentials (cookies, HTTP authentication…) so any OPTIONS request cannot be requested as authenticated. The browser will request as authenticated the actual request (the one with the requested HTTP method like GET, POST…), but not the preflight request.
  • So browsers MUST not send the credentials in OPTIONS request. They will do in actual requests. If you write withCredentials = true the browser should do what I say.

According to your sentence:

It looks like Chrome is pre-flighting all my POSTs due to the content-type: “application/json”:

  • The specification also says that a preflight request will be made by the browser when the header is not a “simple header” and here you have what that means:

    A header is said to be a simple header if the header field name is an ASCII case-insensitive match for Accept, Accept-Language, or Content-Language or if it is an ASCII case-insensitive match for Content-Type and the header field value media type (excluding parameters) is an ASCII case-insensitive match for application/x-www-form-urlencoded, multipart/form-data, or text/plain.

  • application/json is not included so the browser MUST preflight the request as it does.

If anyone finds a solution it would be appreciated.

EDIT: I just found a person with same problem that reflects the real problems, and if you uses the same server as him you will be lucky, https://evolpin.wordpress.com/2012/10/12/the-cors/

More Related Contents:

  1. How to stop CORB from blocking requests to data resources that respond with CORS headers?
  2. Chrome CORS error on request to localhost dev server from remote site
  3. Chrome cancels CORS XHR upon HTTP 302 redirect
  4. CORS error on request to localhost dev server from remote site
  5. Chrome not showing OPTIONS requests in Network tab
  6. Cross-origin request in a content script is blocked by CORB despite the correct CORS headers
  7. How to make a cross-origin request in a content script (currently blocked by CORB despite the correct CORS headers)?
  8. Does –disable-web-security work in Chrome?
  9. CORS issue doesn’t occur when using POSTMAN
  10. “CAUTION: provisional headers are shown” in Chrome debugger
  11. Can Google Chrome open local links?
  12. When running WebDriver with Chrome browser, getting message, “Only local connections are allowed” even though browser launches properly
  13. How to change chrome packaged app id Or Why do we need key field in the manifest.json?
  14. Debugging WebSocket in Google Chrome
  15. chrome extension mv3 – Modularize service worker js file
  16. Chrome stalls when making multiple requests to same resource?
  17. Disable developer mode extensions pop up in Chrome
  18. Is it possible to run Google Chrome in headless mode with extensions?
  19. Using ECMAScript 6
  20. How to download a CRX file from the Chrome web store for a given ID? [closed]
  21. Getting around Chrome’s Malicious File Warning
  22. Chrome not rendering SVG referenced via element
  23. Prevent chrome.notifications API from hiding my notification after a few seconds
  24. Non-Authoritative-Reason header field [HTTP]
  25. Run script each time Chrome extension icon clicked
  26. How can i temporarily disable websocket in Google Chrome?
  27. Chrome remote debugging doesn’t work with IP
  28. Launch IE from a link in Chrome
  29. MP4 not playing on Chrome version 27.0
  30. Creating Google Chrome shortcut with –disable-web-security

Leave a Comment