8

One recurring problem with CORS is that the spec prescribes request headers get stripped from the preflight request (HTTP OPTIONS). However if the server requires authentication, this means the preflight request will fail (because the Authorization header does not get included) and it will not be able to receive the required access-control-allow-origin header.

The only way out seems to be to configure the server to not enforce authentication for HTTP OPTIONS requests. Is there any way in apache 2.4 that i can make Require valid-user conditional on the http method?

1 Answer 1

11

You can limit the scope of Require valid-user by using Limit/LimitExcept :

<LimitExcept OPTIONS>
  Require valid-user
</LimitExcept>

See apache documentation on Limit

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .