nginx-proxy
disable basic authentication for HTTP OPTIONS for CORS
This is to make CORS to work together with basic authentication. OPTIONS should not be restricted as browsers don't send the auth bearer for pre-flight requests
Is there any plan on accepting this fix? We are having the same issue to use CORS + basic nginx Auth, and it's quite cumbersome to re-build everything for one missing line! Thanks a lot! @buchdag
I'm not sure this should be accepted.
When configuring http basic authentication, by default I would expect all requests to only be forwarded after authentication; that way no data can be accidentally leaked to unauthenticated clients.
IMO if any request is excluded from this, it should at least be documented in the README. Perhaps it should also be hidden behind a feature flag / environment variable.
Indeed @tkw1536 it would make sense to make this disabled by default and only enabled if explicitly requested
Still interested @rparree ? I'll take a look when I have some time otherwise