CORS Preflight requests require Authorization

[lg-lima]

Hi colleagues,

I have developed an external webserver that requests some data from ctrlX Datalayer using REST API. Since version 01V20, I'm now having some issues whenever preflight requests are triggered (specifically when not 'simple' (MDN Term) requests are made to the API).

Seems to me, that the Datalayer API is requiring 'Authorization' header even for OPTIONS request, which is not right. We have no control over the CORS request to add such header, this is automatically done by the browser.

https://stackoverflow.com/a/52072116

https://stackoverflow.com/a/40723041

[lg-lima]

One additional comment. This does not happens when using the reverse proxy.

[nickH]

Hi, 

I was able to reproduce the issue. I forwarded it internally. If you got more information on this feel free to share. A private message is also possible. 

[lg-lima]

Additional information. Different APIs handle OPTIONS requests differently.

Authorization API to request token authentication works as expected.

Preflight is triggered -> API response is 204 (Success - No Content)

Datalayer API to read nodes from datalayer doesn't.

Preflight is triggered -> API response is 401 (Error - Unauthorized)

[nickH · Accepted solution]

Hi, 

I got an update for you on this issue. This should be fixed with the next patch of V1.20 (relese is next week) and with the release of V2.02. 

Best regards, 

Nick