{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/619","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/619/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/619/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/619/events","html_url":"https://github.com/hashicorp/vault/issues/619","id":106607803,"number":619,"title":"Cannot make AJAX calls to HTTP API with Token Header","user":{"login":"joeelizondo","id":5739083,"avatar_url":"https://avatars.githubusercontent.com/u/5739083?v=3","gravatar_id":"","url":"https://api.github.com/users/joeelizondo","html_url":"https://github.com/joeelizondo","followers_url":"https://api.github.com/users/joeelizondo/followers","following_url":"https://api.github.com/users/joeelizondo/following{/other_user}","gists_url":"https://api.github.com/users/joeelizondo/gists{/gist_id}","starred_url":"https://api.github.com/users/joeelizondo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joeelizondo/subscriptions","organizations_url":"https://api.github.com/users/joeelizondo/orgs","repos_url":"https://api.github.com/users/joeelizondo/repos","events_url":"https://api.github.com/users/joeelizondo/events{/privacy}","received_events_url":"https://api.github.com/users/joeelizondo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-09-15T17:40:56Z","updated_at":"2015-09-15T18:46:51Z","closed_at":null,"body":"Running an angular instance on a dev env at localhost:8000 I'm hitting a vault ec2 instance with a consul backend also hosted on ec2, both on their default ports 8200 and 8500 respectively. The problem comes when my app tries a simple read operation using a valid token.\r\n\r\n```\r\n$http.get(\"http://XXXXXX.us-east-1.elb.amazonaws.com:8200/v1/secret\" + key_path,\r\n                      {\r\n                          headers: {'X-Vault-Token': token}\r\n                      })\r\n                      .then(function(response) {\r\n                          $scope.data.value = response.data.value;\r\n                      }, onError);\r\n```\r\n\r\nInstead of a GET request an OPTIONS request is being initiated and the vault server returns a 405. I've googled around and everyone seems to think this is CORS related, however I'm sending a request from my local host to a ec2 instance and having this problem. So it doesn't seem like CORS to me. It seems more like the problem is the custom 'X-Vault-Token' header that needs to be passed. The browser is sending a preflight request trying to determine if that is a valid header and perhaps its not? Is there some way to modify configuration of vault to allow for the OPTIONS verb as well as modify the allowed headers to include that 'X-Vault-Token' header as acceptable?"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/140495868","html_url":"https://github.com/hashicorp/vault/issues/619#issuecomment-140495868","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/619","id":140495868,"user":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T18:46:51Z","updated_at":"2015-09-15T18:46:51Z","body":"@adamdecaf You can do that; keep in mind that if you are decrypting in the LB and then re-encrypting you have a transitive trust issue (if that is a concern in your security policy)."}}