-1

I try axios call a external domain: https://viacep.com.br/ws/20021040/json/ (get call to return any informations about zip code)

axios.get('https://viacep.com.br/ws/20021040/json')
              .then((response) => {
                alert(JSON.stringify(response))
              })
              .catch((error) => {
                alert(error)
              })

In front-end I use:

  • axios: v0.17.1
  • vue: v2.5.3
  • webpack: 3.6.0

In back-end I use expressjs/nodejs and install the express cors to deal with this case.

  • node 9.8.0
  • express 4.15.2
  • cors 2.8.4

I need figure out to how allow the Request header field authorization in Access-Control_allow-Headers in preflight response to it work fine.

I'm developing in my localhost:8021

Authorization is a token with the credentials of my authentication(JWT).

In the image below, any tests commenteds.

enter image description here

Best Regards.

My last test is:

var corsOptions = {
    origin: true,
    allowedHeaders: ['Content-Type', 'authorization', 'Content-Length', 'X-Requested-With', 'Accept'],
    exposedHeaders: ['authorization'],
    methods: ['GET', 'PUT', 'POST', 'DELETE', 'OPTIONS'],
    // optionsSuccessStatus: 204, // some legacy browsers (IE11, various SmartTVs) choke on 204
    preflightContinue: false
}
app.use(cors(corsOptions))

But it doesn't work anyway... =(

felipe muner
  • 357
  • 2
  • 6
  • 13
  • possible duplicate of [Link1](https://stackoverflow.com/questions/42061727/cors-error-request-header-field-authorization-is-not-allowed-by-access-control/42061962) and [Link2](https://stackoverflow.com/questions/25727306/request-header-field-access-control-allow-headers-is-not-allowed-by-access-contr) – Siddhesh Salgaonkar May 09 '18 at 01:03
  • No, because i tried it and doesn't work. app.use(function(req,res,next){ // res.header('Access-Control-Allow-Origin', "http://localhost:8021") // res.header('Access-Control-Allow-Methods', "GET,PUT,POST,DELETE,OPTIONS") console.log('vou fazer'); res.header("Access-Control-Allow-Headers", "authorization, vai tomar no cu"); next() }) – felipe muner May 09 '18 at 01:25

1 Answers1

0

Try:

res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept')
res.header('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE, PATCH, OPTIONS');
ReyHaynes
  • 2,932
  • 1
  • 15
  • 22