title: Authorization header not being sent in AJAX request
body: <p>I'm having issues properly sending an Authorization header along with an AJAX request. I've read that this might be a CORS issue, but I believe everything is configured correctly. Here's the code on the client side:</p>
  
  <pre><code>    $.ajax({
          url: &lt;location&gt;,
          method: "GET",
          headers: {"Authorization": 'Bearer ' + token},
          success: function (user) {
              Cookies.set('user', user, {expires: 1});
          }
      });
  </code></pre>
  
  <p>And here's the some of the code for the server side (using Express). Middleware for CORS:</p>
  
  <pre><code>app.use(function (req, res, next) {
      res.header('Access-Control-Allow-Origin', req.headers.origin || "*");
      res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, HEAD, DELETE, OPTIONS');
      res.header("Access-Control-Allow-Headers", "Authorization, Origin, X-Requested-With, Content-Type, Accept");
      next();
  });
  </code></pre>
  
  <p>And my middleware to check for the Authorization header:</p>
  
  <pre><code> app.use(function (req, res, next) {
          var config, authorization;
  
          authorization = req.get('authorization');
          if (!authorization) throw new NoAuthenticationError();
  ...
  </code></pre>
  
  <p>But nada.</p>
  
  <p>When I examine the headers from the second middleware, I noticed that <code>req.headers</code> contains <code>access-control-request-headers: "accept, authorization"</code> but the explicit Authorization header doesn't exist from the server end.</p>
  
  <p>Any ideas?</p>
  
  <p><strong>Edit</strong>: I've now realized that I have to handle jQuery's initial preflight OPTIONS request separately. I'll do that and report back...</p>