OPTIONS get 401 - preflight request doesn't pass access control check on Apache

Question

Server in Use is Apache which is configured for Basic Auth

<LocationMatch "^/login/(.*)$">
    AllowMethods POST OPTIONS

    <LimitExcept OPTIONS>
            Require valid-user
            Header always set Access-Control-Allow-Origin "*"
            Header always set Access-Control-Allow-Headers "authorization,content-type"
            Header always set Access-Control-Allow-Method "POST,OPTIONS"           
    </LimitExcept>

    AuthType basic
    AuthName "Authentication Required"
    AuthBasicProvider file
    AuthUserFile    "/etc/sec/.secret-file"
    LogLevel debug
    Require valid-user
    ErrorDocument 401 "Authorization Failure"
    RequestHeader set X-Authenticated-User %{REMOTE_USER}s
    ProxyPass "http://127.0.0.1:8080/$1"
</LocationMatch>

Angular 2 code is as following -

public login = (resrc: string, item: any): Observable<any> => {
    this.headers.append('Authorization', 'Basic ' + btoa(item['userName']+':'+item['password']));
    let options = new RequestOptions({ headers: this.headers, withCredentials: true });
    return this._http.post(this.serverUrl+"login/"+this.apiUrl+resrc,{}, options)
        .timeoutWith(5000, Observable.throw(new Error('Request timed out.')))
        .map((response: Response) => { return response; })
        .catch(this.handleError);
}

Request Header PDU -

OPTIONS /login/api/system/sessions/ HTTP/1.1
Host: domain
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost:3010
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Access-Control-Request-Headers: authorization,content-type
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response Header PDU -

HTTP/1.1 401 Unauthorized
Date: Mon, 08 Jan 2018 14:00:48 GMT
Server: Apache
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: authorization,content-type
Access-Control-Allow-Method: POST,OPTIONS
WWW-Authenticate: Basic realm="Authentication Required"
Content-Length: 21
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

I am getting 401 (Unauthorised error) with following details -

zone.js:1981 OPTIONS https://domain/login/api/system/sessions/ 401 (Unauthorized)

:3010/#/login:1 Failed to load https://domain/login/api/system/sessions/: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost:3010' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

Can anyone please help me out with this.

I was also facing this kind of issue, but i was facing this in spring. Issue was coming because server is trying to authenticate preflight request and which was failing. So I wrote a filter which explicitly returning OPTION request with proper response headers, without doing authentication. — Vipul Goyal

roryhewitt roryhewitt · Accepted Answer · 2018-01-08T20:44:30

The comment on your post from @vipul-goyal is almost certainly the correct answer - your server is checking for a valid Authorization request header in the OPTIONS preflight request.

The simplest solution is to bypass authorization checking on OPTIONS requests. This isn't really a security hole, especially if you only do this bypass for preflight OPTIOSN requests (by checking for both method==OPTIONS and the existence of the Access-Control-Request-Method request header). For any other OPTIONS requests, continue to do authorization checking.

OPTIONS get 401 - preflight request doesn't pass access control check on Apache

2 Answers