Need 'Access-Control-Allow-Credentials' header about flask-cors HOT 3 CLOSED

Hey!

Thanks for writing in! There is an option just for that! Set
supports_credentials either as a kwarg, or else an app config.

It looks like the documentation build is currently messed up, and it is
difficult to find these options. I'm currently away for the weekend, and
will look into fixing his when I return.
On Fri, Oct 16, 2015 at 7:32 AM kk [email protected] wrote:

Here is my case:

Client post username and password to server, after authentication,
Server send header "Authorization" with auth token to client, then client
save the token.
Client and server is not in the same domain, so I need CORS.

server code:

from flask.ext.cors import CORS
CORS(app)

But it cause 'Refused to get unsafe header "Authorization"'

// xhr is response object
xhr = XMLHttpRequest {}, key = "Authorization"
xhr.getResponseHeader(key); // error

Then I set:

req.withCredentials=true

Then error:

XMLHttpRequest cannot load http://www.xxxx.cn/api/user/login. Credentials flag is 'true',        but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials. Origin   'http://127.0.0.1:5000' is therefore not allowed access.

I find a clue on
http://stackoverflow.com/questions/24687313/what-exactly-does-the-access-control-allow-credentials-header-do

So, it need 'Access-Control-Allow-Credentials' header

—
Reply to this email directly or view it on GitHub
#133.

from flask-cors.

thank you, I read the source code and find these options.

from flask-cors.

Great, thanks for the report! I have recently merged improvements to the documentation to make it easier to find (hopefully).

from flask-cors.