{"action":"created","issue":{"url":"https://api.github.com/repos/lonelycode/tyk/issues/112","labels_url":"https://api.github.com/repos/lonelycode/tyk/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/lonelycode/tyk/issues/112/comments","events_url":"https://api.github.com/repos/lonelycode/tyk/issues/112/events","html_url":"https://github.com/lonelycode/tyk/issues/112","id":108281160,"number":112,"title":"CORS headers on a per-key basis","user":{"login":"richard-hulm","id":11884765,"avatar_url":"https://avatars.githubusercontent.com/u/11884765?v=3","gravatar_id":"","url":"https://api.github.com/users/richard-hulm","html_url":"https://github.com/richard-hulm","followers_url":"https://api.github.com/users/richard-hulm/followers","following_url":"https://api.github.com/users/richard-hulm/following{/other_user}","gists_url":"https://api.github.com/users/richard-hulm/gists{/gist_id}","starred_url":"https://api.github.com/users/richard-hulm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richard-hulm/subscriptions","organizations_url":"https://api.github.com/users/richard-hulm/orgs","repos_url":"https://api.github.com/users/richard-hulm/repos","events_url":"https://api.github.com/users/richard-hulm/events{/privacy}","received_events_url":"https://api.github.com/users/richard-hulm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-09-25T08:05:19Z","updated_at":"2015-10-29T08:54:51Z","closed_at":null,"body":"When an API key is created, it would be good to be able to add CORS information, at least domains if not the entire range of CORS options (methods etc).\r\n\r\nCurrently, it's possible to update the API definition with a big list of all the cors headers required, but this leaves the headers in the definition with nothing directly linking them to the user that requested it.\r\n\r\nThis would also open each user to only asking for the HTTP methods they were using which could make a slight difference in security?"},"comment":{"url":"https://api.github.com/repos/lonelycode/tyk/issues/comments/152116224","html_url":"https://github.com/lonelycode/tyk/issues/112#issuecomment-152116224","issue_url":"https://api.github.com/repos/lonelycode/tyk/issues/112","id":152116224,"user":{"login":"lonelycode","id":2444409,"avatar_url":"https://avatars.githubusercontent.com/u/2444409?v=3","gravatar_id":"","url":"https://api.github.com/users/lonelycode","html_url":"https://github.com/lonelycode","followers_url":"https://api.github.com/users/lonelycode/followers","following_url":"https://api.github.com/users/lonelycode/following{/other_user}","gists_url":"https://api.github.com/users/lonelycode/gists{/gist_id}","starred_url":"https://api.github.com/users/lonelycode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lonelycode/subscriptions","organizations_url":"https://api.github.com/users/lonelycode/orgs","repos_url":"https://api.github.com/users/lonelycode/repos","events_url":"https://api.github.com/users/lonelycode/events{/privacy}","received_events_url":"https://api.github.com/users/lonelycode/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T08:54:51Z","updated_at":"2015-10-29T08:54:51Z","body":"@manjeshpv Interesting, not sure this is the right place for this question as this ticket is specifically for a new feature.\r\n\r\n1. Have you tried it with a wildcard allowed origin (i think the allowed origin should just be http://teambnw.com)?\r\n2. Have you tried using a custom header instead of Authorization?\r\n3. You have OPTIONS pass-through enabled, which means that the OPTIONS request is being handled by the rest of the Tyk middleware and being allowed through to your underlying service, which could be writing new CORS headers to the response which could be causing the conflict\r\n\r\nTo debug, can you share the actual response headers from both the pre-flight OPTIONS and attempted request?"}}