{"action":"closed","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/3766","labels_url":"https://api.github.com/repos/coreos/etcd/issues/3766/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/3766/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/3766/events","html_url":"https://github.com/coreos/etcd/issues/3766","id":113806638,"number":3766,"title":"Cross-domain request fails when using authentication","user":{"login":"densetsunozero","id":1938150,"avatar_url":"https://avatars.githubusercontent.com/u/1938150?v=3","gravatar_id":"","url":"https://api.github.com/users/densetsunozero","html_url":"https://github.com/densetsunozero","followers_url":"https://api.github.com/users/densetsunozero/followers","following_url":"https://api.github.com/users/densetsunozero/following{/other_user}","gists_url":"https://api.github.com/users/densetsunozero/gists{/gist_id}","starred_url":"https://api.github.com/users/densetsunozero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/densetsunozero/subscriptions","organizations_url":"https://api.github.com/users/densetsunozero/orgs","repos_url":"https://api.github.com/users/densetsunozero/repos","events_url":"https://api.github.com/users/densetsunozero/events{/privacy}","received_events_url":"https://api.github.com/users/densetsunozero/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"yichengq","id":2976232,"avatar_url":"https://avatars.githubusercontent.com/u/2976232?v=3","gravatar_id":"","url":"https://api.github.com/users/yichengq","html_url":"https://github.com/yichengq","followers_url":"https://api.github.com/users/yichengq/followers","following_url":"https://api.github.com/users/yichengq/following{/other_user}","gists_url":"https://api.github.com/users/yichengq/gists{/gist_id}","starred_url":"https://api.github.com/users/yichengq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yichengq/subscriptions","organizations_url":"https://api.github.com/users/yichengq/orgs","repos_url":"https://api.github.com/users/yichengq/repos","events_url":"https://api.github.com/users/yichengq/events{/privacy}","received_events_url":"https://api.github.com/users/yichengq/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-10-28T12:08:18Z","updated_at":"2015-11-10T16:05:53Z","closed_at":"2015-11-10T16:05:53Z","body":"Hi,\r\nI am setting up a web service to fetch data from etcd server and render the result on the page. Since the web server and the etcd server are on different domain, this will be a cross-domain request. Browser like Firefox will first send a `OPTIONS` request to test if the target server accepts the cross-domain request. I started the etcd server with `-cors *` so it will receive cross-domain requests from any domain.\r\n\r\nEverything worked fine until I enabled authentication. Etcd use basic http authentication, so the `GET` request will contain `Authorization` header, this will cause the browser put `Access-Control-Request-Headers: authorization` in the `OPTIONS` request, but etcd will not put authorization in the `Access-Control-Allow-Headers` it returns, thus the request will always fail.\r\n\r\nThis is the `OPTIONS` request:\r\nOPTIONS /v2/keys/transport/?recursive=true&_=1446015242536 HTTP/1.1\r\nHost: dev03:2379\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.7,ja;q=0.3\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://adsvm060\r\nAccess-Control-Request-Method: GET\r\n__Access-Control-Request-Headers: authorization___\r\nConnection: keep-alive\r\n\r\nThis is the reponse:\r\nHTTP/1.1 200 OK\r\n__Access-Control-Allow-Headers: accept, content-type__\r\nAccess-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE\r\nAccess-Control-Allow-Origin: *\r\nDate: Wed, 28 Oct 2015 06:54:04 GMT\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nI think we just need to add `authorization` into the `Access-Control-Allow-Headers`. Thanks."}}