I want my server to allow 'Authorization' header for my mobile app. Currently my webserver is in sails and I use sails. My routes code is

'post /auth/local' : {
    cors: {
       origin: '*'    
    },
    controller: 'AuthController',
    action: 'callback'
},

When my client sends a request with 'Authorization' in header I get error

XMLHttpRequest cannot load http://localhost:1337/auth/local. 
Request header field Authorization is not allowed by Access-Control-Allow-Headers.

How do I specify in my routes code that 'Authorization' header is also allowed?

I want my server to allow 'Authorization' header for my mobile app. Currently my webserver is in sails and I use sails. My routes code is

'post /auth/local' : {
    cors: {
       origin: '*'    
    },
    controller: 'AuthController',
    action: 'callback'
},

When my client sends a request with 'Authorization' in header I get error

XMLHttpRequest cannot load http://localhost:1337/auth/local. 
Request header field Authorization is not allowed by Access-Control-Allow-Headers.

How do I specify in my routes code that 'Authorization' header is also allowed?

• javascript
• express
• routes
• cors
• sails.js

Share Improve this question Follow edited Jul 28, 2015 at 2:11 rnrneverdies 15.7k99 gold badges6666 silver badges9595 bronze badges asked Jul 19, 2015 at 4:40 rajuraju 5,0081717 gold badges6767 silver badges121121 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 15

Add headers : 'Content-Type, Authorization' to cors object, like example below:

'post /auth/local' : {
    cors: {
       origin: '*',
       headers: 'Content-Type, Authorization'  
    },
    controller: 'AuthController',
    action: 'callback'
},

headers: Comma-delimited list of headers that are allowed to be sent with CORS requests. This is only used in response to preflight requests.

Source: Sails CORS Config

Notice that Content-Type is also required due is the default value of that property and is required for POST and PUT methods.