Request header field is not allowed by Access-Control-Allow-Headers with $http

Question

I'm doing a POST to a service using Postman Chrome Extension, and I get the expected response.

But, when I do the same POST request using $http, all goes to hell.

I get a :

Request header field Engaged-Auth-Token is not allowed by Access-Control-Allow-Headers

Engaged-Auth-Token being a header.

I've no idea why with Postman works and it doesn't work with Chrome...

Any ideas?

score 7 · Answer 1 · answered Jun 18 '15 at 12:50

I believe configuring the Access-Control-Allow-Headers on the $httpProvider on the CLIENT will not work. I think the header needs to be configured on the server (as a response header). In a node-express application for instance, this could be done with a middleware (for example), putting something like this:

res.header('*')

or (more selectively) just the headers you need:

res.header('Engaged-Auth-Token, Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');

score 1 · Accepted Answer · edited Jun 30 '15 at 12:42

The issue is because of missing Access-Control-Allow-Headers from request Header. To fix this we need to add Access-Control-Allow-Headers: * to request header

Add a Access-Control-Allow-Headers to the http request header. You can do this at app level using $httpProvider. Add below line in your app config section to add this header.

var app = angular.module("app", [
    "ngRoute",
    "app.controllers",
    "app.directives",
    "app.filters"
]);

app.config([
    "$routeProvider",
    "$httpProvider",
    function($routeProvider, $httpProvider){
        $httpProvider.defaults.headers.common['Access-Control-Allow-Headers'] = '*';
    }
]);

I believe this needs to read $httpProvider.defaults.headers.common['Access-Control-Allow-Headers'] = '*'; Note the quotes around * otherwise you'll get all kinds of errors. — Jesse Carter, Oct 20 '14 at 21:21

score 0 · Answer 3 · answered Dec 17 '16 at 23:38

if use sails api on backend change cors.js and add your token filed here

module.exports.cors = {
  allRoutes: true,
  origin: '*',
  credentials: true,
  methods: 'GET, POST, PUT, DELETE, OPTIONS, HEAD',
  headers: 'Origin, X-Requested-With, Content-Type, Accept, Engaged-Auth-Token'
};

Request header field is not allowed by Access-Control-Allow-Headers with $http

3 Answers3

Linked