{"action":"created","issue":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/9395","labels_url":"https://api.github.com/repos/woothemes/woocommerce/issues/9395/labels{/name}","comments_url":"https://api.github.com/repos/woothemes/woocommerce/issues/9395/comments","events_url":"https://api.github.com/repos/woothemes/woocommerce/issues/9395/events","html_url":"https://github.com/woothemes/woocommerce/issues/9395","id":112516214,"number":9395,"title":"CORS GET with Authorization header causing 401 preflight (OPTIONS)","user":{"login":"limbera","id":2503457,"avatar_url":"https://avatars.githubusercontent.com/u/2503457?v=3","gravatar_id":"","url":"https://api.github.com/users/limbera","html_url":"https://github.com/limbera","followers_url":"https://api.github.com/users/limbera/followers","following_url":"https://api.github.com/users/limbera/following{/other_user}","gists_url":"https://api.github.com/users/limbera/gists{/gist_id}","starred_url":"https://api.github.com/users/limbera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/limbera/subscriptions","organizations_url":"https://api.github.com/users/limbera/orgs","repos_url":"https://api.github.com/users/limbera/repos","events_url":"https://api.github.com/users/limbera/events{/privacy}","received_events_url":"https://api.github.com/users/limbera/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/woothemes/woocommerce/labels/Needs%20Dev%20Feedback","name":"Needs Dev Feedback","color":"a46497"}],"state":"closed","locked":false,"assignee":{"login":"claudiosmweb","id":1264099,"avatar_url":"https://avatars.githubusercontent.com/u/1264099?v=3","gravatar_id":"","url":"https://api.github.com/users/claudiosmweb","html_url":"https://github.com/claudiosmweb","followers_url":"https://api.github.com/users/claudiosmweb/followers","following_url":"https://api.github.com/users/claudiosmweb/following{/other_user}","gists_url":"https://api.github.com/users/claudiosmweb/gists{/gist_id}","starred_url":"https://api.github.com/users/claudiosmweb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claudiosmweb/subscriptions","organizations_url":"https://api.github.com/users/claudiosmweb/orgs","repos_url":"https://api.github.com/users/claudiosmweb/repos","events_url":"https://api.github.com/users/claudiosmweb/events{/privacy}","received_events_url":"https://api.github.com/users/claudiosmweb/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-10-21T05:33:53Z","updated_at":"2015-10-23T02:24:21Z","closed_at":"2015-10-22T16:24:39Z","body":"I am serving a JavaScript web client from a different box to the Wordpress application and have configured CORS in the .htaccess file appropriately.\r\n\r\nA GET request to /wc-api/v3/products/56 (with Authorization: Basic in the headers) is causing a preflight check. That OPTIONS request is returning 401 unauthorized. \r\n\r\nHere is the .htaccess config that I am using: \r\n````\r\n    <ifModule mod_headers.c>\r\n        Header always set Access-Control-Allow-Origin: \"*\"\r\n        Header always set Access-Control-Allow-Methods \"POST, GET, OPTIONS\"\r\n        Header always set Access-Control-Allow-Headers \"authorization\"\r\n    </ifModule>\r\n````\r\nHere is the JavaScript causing the issue:\r\n````\r\n    var consumerKey = \"<redacted>\";\r\n    var consumerSecret = \"<redacted>\";\r\n    var xhr = new XMLHttpRequest();\r\n    xhr.open(\"get\", \"https://www.<redacted>.com/wc-api/v3/products/56\", true);\r\n    xhr.setRequestHeader(\"Authorization\", \"Basic \" + btoa(consumerKey + \":\" + consumerSecret));\r\n    xhr.send();\r\n````\r\n\r\nI have tried adding this to the .htaccess file to force all OPTIONS to 200:\r\n````\r\n    RewriteCond %{REQUEST_METHOD} OPTIONS\r\n    RewriteRule ^(.*)$ $1 [R=200,L]\r\n````\r\nHere is the Response Headers and Request Headers from chrome dev tools:\r\n![cors_issue](https://cloud.githubusercontent.com/assets/2503457/10628430/f8855a9e-7810-11e5-8bc1-a48806f21f46.png)"},"comment":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/comments/150415156","html_url":"https://github.com/woothemes/woocommerce/issues/9395#issuecomment-150415156","issue_url":"https://api.github.com/repos/woothemes/woocommerce/issues/9395","id":150415156,"user":{"login":"claudiosmweb","id":1264099,"avatar_url":"https://avatars.githubusercontent.com/u/1264099?v=3","gravatar_id":"","url":"https://api.github.com/users/claudiosmweb","html_url":"https://github.com/claudiosmweb","followers_url":"https://api.github.com/users/claudiosmweb/followers","following_url":"https://api.github.com/users/claudiosmweb/following{/other_user}","gists_url":"https://api.github.com/users/claudiosmweb/gists{/gist_id}","starred_url":"https://api.github.com/users/claudiosmweb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claudiosmweb/subscriptions","organizations_url":"https://api.github.com/users/claudiosmweb/orgs","repos_url":"https://api.github.com/users/claudiosmweb/repos","events_url":"https://api.github.com/users/claudiosmweb/events{/privacy}","received_events_url":"https://api.github.com/users/claudiosmweb/received_events","type":"User","site_admin":false},"created_at":"2015-10-23T02:24:21Z","updated_at":"2015-10-23T02:24:21Z","body":"So your server is not setting the `PHP_AUTH_USER` and `PHP_AUTH_PW`.\r\n\r\nTry it:\r\n\r\n```\r\nRewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]\r\n```\r\n\r\nOr you can try pass as query strings:\r\n\r\n```\r\n/wc-api/v3/products/56?consumer_key=xxx&consumer_secret=xxx\r\n```"}}