AngularJS is not sending Auth header

Question

im trying to make an interceptor that appends an user token if exists on every request, the token exists but it doesnt send it... After the call is made I look at F12 ( Chrome Dev Tools) the call and the Authorization header is not there...

But if I debug it step by step I can see how in the config.headers.Authorization is there my token... but still not sending it throu the request... May I ask for some help please?

This is my interceptor

$httpProvider.interceptors.push(function($q, $location, $cookies){
    return {
        request: function(config){
            config.headers = config.headers || {};
            let token = $cookies.get('user');
            if (token) {
                config.headers.Authorization = 'Bearer ' + token;
            }
            return config;
        },
        response: function(response){
            return response;
        },
        responseError: function(response){
            if(response.status === 401 || response.status === 403){
                $location.path('/login')
            }
            return $q.reject(response);
        }
    }
  })

CORS config

var allowCrossDomain = function(req, res, next) {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, DELETE, OPTIONS');
    res.header('Access-Control-Allow-Headers', 'X-Requested-With,Content-Type,Authorization');
    next();
}

Config before it be send

config before it be send

req/res preflight

Does your preflight options request return Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization? — lin
– lin, Commented Jun 12, 2017 at 11:20
Yes It does, those are the allowed headers I've put on my server side — FridoxFL
– FridoxFL, Commented Jun 12, 2017 at 11:22
Could you try to console.log(config); directly above return config; is your configuration inside? It all seems fine to me right now. — lin
– lin, Commented Jun 12, 2017 at 11:36
Okay, I've just attached the picture to the OP, it seems all right to me too, im attaching the req/res on the preflight too — FridoxFL
– FridoxFL, Commented Jun 12, 2017 at 11:42

lin · Accepted Answer · 2017-06-12 11:54:08Z

2

Ensure that your OPTIONS request does not need an "auth" and you will be fine. The W3 spec for CORS preflight requests says that user credentials should be excluded.

If HTTP-Status 401 has been returned by an OPTIONS request , a subrequest should not be send by the client. But it seems like there is a bug with some browsers. This browsers does send a subrequest even if the OPTIONS request returned 401.

In node.js you could check the request method by using req.method === 'OPTIONS'.

edited Jun 12, 2017 at 11:54

answered Jun 12, 2017 at 11:33

lin

18.4k4 gold badges66 silver badges88 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

FridoxFL Over a year ago

Thanks you, this fixed my problem, i've justs added this if (req.method === "OPTIONS") res.sendStatus(200); else next();

Collectives™ on Stack Overflow

AngularJS is not sending Auth header

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related