One recurring problem with CORS is that the spec prescribes request headers get stripped from the preflight request (HTTP OPTIONS). However if the server requires authentication, this means the preflight request will fail (because the Authorization
header does not get included) and it will not be able to receive the required access-control-allow-origin
header.
The only way out seems to be to configure the server to not enforce authentication for HTTP OPTIONS requests. Is there any way in apache 2.4 that i can make Require valid-user
conditional on the http method?