Basic HTTP authorization header
<p>I would like to set-up a basic HTTP-Authentication using JQuery on the client-side and Node.js on the server side. 
I have made the following Ajax request on the server side to set the headers: </p>

<pre><code>$.ajax({
        type: "GET",
        url: URL_SLACK_SERVER,
        dataType: "json",
        beforeSend: function(xhr){
            xhr.setRequestHeader("Authorization", "Basic " +btoa("username:xxx") );
        },
        success:function(rsp){
            filterMessages(rsp);
        }
    });
</code></pre>

<p>Which I want to use on my server side using the <a href="https://www.npmjs.com/package/basic-auth" rel="nofollow noreferrer">basic-auth</a> module:</p>

<pre><code>var express = require('express');
var bodyParser = require('body-parser');
var auth = require('basic-auth');

app.use(function(req, res, next) {
  res.header("Access-Control-Allow-Origin", "*");
  res.header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Authorization, Accept, Key");
  var cre = +auth(req);
  console.log('Auth: ' +cre.username);
  next();
});
</code></pre>

<p>But, doing this way, I encounter some issues: </p>

<ol>
<li>I do not see that the header are set in the preflight OPTIONS HTTP request: </li>
</ol>

<blockquote>
  <p>OPTIONS /server HTTP/1.1 <br>
      Host: server.com <br>
      Connection: keep-alive <br>
      Access-Control-Request-Method: GET <br>
      Origin: null<br>
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111
  Safari/537.36<br>
      Access-Control-Request-Headers: accept, authorization<br>
      Accept: <em>/</em><br>
      Accept-Encoding: gzip, deflate, sdch<br>
      Accept-Language: en-US,en;q=0.8,fr;q=0.6</p>
</blockquote>

<ol start="2">
<li>I got the following error, which I do not understand well: </li>
</ol>

<blockquote>
  <p>Request header field Authorization is not allowed by
  Access-Control-Allow-Headers in preflight response.</p>
</blockquote>

<p>Also, please note that the call from the client to the server is a cross-domain call, that's why there is these set headers written on the Node.js file. </p>

<p>How can I efficiently perform this basic HTTP-Authentication?</p>