CODEWITHSUNDEEP
angularjsasp.net-web-apixmlhttprequestcross-domain
BotanMan
BotanMan

Reputation: 1417

401 Unauthorized status code for cross-domain OPTIONS request

I use cross-domain requests for Angularjs + MVC WebAPI, in the case browser sends two requests first of them with OPTIONS type but i get 401 status code: http://grab.by/vrsA

I added Access-Control-* attributes to WebApi web.config file:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By"/>
    <remove name="X-AspNet-Version"/>
    <add name="Access-Control-Allow-Origin" value="*"/>
    <add name="Access-Control-Allow-Headers" value="content-type, accept, authorization, origin, referer, user-agent, x-token"/>
    <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS"/>
  </customHeaders>
</httpProtocol>

so, can somebody explain my why?

Upvotes: 0

Views: 3276

Answers (1)

lalatnayak
lalatnayak

Reputation: 170

The preflight (OPTIONS) request is sent without any security headers. You'll need to make sure that your webserver allows anonymous OPTIONS requests

Upvotes: 1

Related Questions