{"action":"created","issue":{"url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/12","labels_url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/12/comments","events_url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/12/events","html_url":"https://github.com/lucj/sails-oauth2-api/issues/12","id":116585029,"number":12,"title":"CORS 'Access-Control-Allow-Origin' does not present in header","user":{"login":"lst2","id":8383972,"avatar_url":"https://avatars.githubusercontent.com/u/8383972?v=3","gravatar_id":"","url":"https://api.github.com/users/lst2","html_url":"https://github.com/lst2","followers_url":"https://api.github.com/users/lst2/followers","following_url":"https://api.github.com/users/lst2/following{/other_user}","gists_url":"https://api.github.com/users/lst2/gists{/gist_id}","starred_url":"https://api.github.com/users/lst2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lst2/subscriptions","organizations_url":"https://api.github.com/users/lst2/orgs","repos_url":"https://api.github.com/users/lst2/repos","events_url":"https://api.github.com/users/lst2/events{/privacy}","received_events_url":"https://api.github.com/users/lst2/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-12T16:25:48Z","updated_at":"2015-11-13T09:33:24Z","closed_at":null,"body":"I cope with a CORS issue when I request a POST to '/oauth/token' from my local ember client. \r\n\r\n\"XMLHttpRequest cannot load http://localhost:1337/oauth/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access.\"\r\n\r\nHowever I set config/cors.js to accept '*' origin.\r\n\r\nAnother API running on Sails 0.10 with same cors.js config returns right headers. \r\n\r\nHow this could be, why Sails does not return this header, any idea? "},"comment":{"url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/comments/156376998","html_url":"https://github.com/lucj/sails-oauth2-api/issues/12#issuecomment-156376998","issue_url":"https://api.github.com/repos/lucj/sails-oauth2-api/issues/12","id":156376998,"user":{"login":"lst2","id":8383972,"avatar_url":"https://avatars.githubusercontent.com/u/8383972?v=3","gravatar_id":"","url":"https://api.github.com/users/lst2","html_url":"https://github.com/lst2","followers_url":"https://api.github.com/users/lst2/followers","following_url":"https://api.github.com/users/lst2/following{/other_user}","gists_url":"https://api.github.com/users/lst2/gists{/gist_id}","starred_url":"https://api.github.com/users/lst2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lst2/subscriptions","organizations_url":"https://api.github.com/users/lst2/orgs","repos_url":"https://api.github.com/users/lst2/repos","events_url":"https://api.github.com/users/lst2/events{/privacy}","received_events_url":"https://api.github.com/users/lst2/received_events","type":"User","site_admin":false},"created_at":"2015-11-13T09:33:24Z","updated_at":"2015-11-13T09:33:24Z","body":"Actually the request's response against oauth/token is made fom password.js of oauth2orize node module dependency which set headers itself, disregarding Sails CORS config.\r\n\r\n```javascript\r\n//! oauth2orize/lib/exchange/password.js\r\nfunction issued(err, accessToken, refreshToken, params) {\r\n// [...]\r\n  res.setHeader('Content-Type', 'application/json');\r\n  res.setHeader('Access-Control-Allow-Origin', '*');\r\n  res.setHeader('Cache-Control', 'no-store');\r\n  res.setHeader('Pragma', 'no-cache');\r\n  res.end(json);\r\n}\r\n\r\ntry {\r\n  var arity = issue.length;\r\n  if (arity == 6) {\r\n    issue(client, username, passwd, scope, req.body, issued);\r\n  } else if (arity == 5) {\r\n    issue(client, username, passwd, scope, issued);\r\n  } else { // arity == 4\r\n    issue(client, username, passwd, issued);\r\n  }\r\n} catch (ex) {\r\n  return next(ex);\r\n}\r\n```\r\n\r\nIn my case, I've modified oauth2orize/lib/exchange/password.js to make it match with specific headers needs. It is not a reliable solution.\r\n\r\nDo we should use a way to apply Sails config to oauth2orize response request ? That sounds better.\r\n"}}