The first confusion I had tackling this problem was understanding what a preflight request means. So I will start from there.
Browsers send preflight requests whenever a request does not meet these criteria:
- HTTP methods matches one of (case-sensitive):
- HTTP Headers matches (case-insensitive):
- Accept
- Accept Language
- Content Language
- Last-Event-ID
- Content-Type, but only if the value is one of:
- application/x-www-form-urlencoded
- multipart/form-data
- text/plain
Preflight requests are made with an OPTIONS method that includes three additional headers that your server may not be expecting if it is not configured for CORS. They are:
- Access-Control-Allow-Headers
- Access-Control-Allow-Origin
- Access-Control-Allow-Methods
If the server isn't configured for CORS, it simply responds with an empty header having HTTP status code 200. Once you have configured the server for CORS, you should include the headers listed above as headers supported by CORS.
That should clear the error and allow you communicate with the server.
Note: While your server can handle the custom header you created (in my case, Authorization
for JWT authentication), it most likely won't be configured for CORS request. If you have access to your server, simply find out how to configure CORS for that server.
For more information about CORS. See https://www.html5rocks.com/en/tutorials/cors/