Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource

Question

I have done a fair bit of searching for the past few days and I can not get this to work properly.

I am using AngularJS & Webapp2 Python (Google App Engine).

I am using a factory resource:

app.factory('facTest', ['$resource', function ($resource) {
    return $resource('http://localhost:10080/:route', {}, {
        GetTest: { method: 'GET', isArray: false, params: { route: "gettest", user_id: '@user_id' } }
    })
}]);

This works great however on WebApp2 I need to add:

self.response.headers['Access-Control-Allow-Origin'] = '*'

Or I get a similar issue.

My problem is when I am trying to send custom headers via AngularJS:

$http.defaults.headers.common.Authorization = 'Basic ' + "123454";

When I do I am getting errors. I am trying to add a token to the header before all HTTP calls.

I have tried adding this to the python WebApp2

 self.response.headers['Access-Control-Allow-Headers'] = 'X-Requested-With, Content-Type, X-Codingpedia, Authorization'
 self.response.headers['Access-Control-Allow-Methods'] = 'GET, POST, DELETE, PUT, OPTIONS'

I am still getting that same error.

"OPTIONS http://localhost:10080/gettest?user_id=1 405 (Method Not Allowed)"

"XMLHttpRequest cannot load http://localhost:10080/gettest?user_id=1. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource."

Any help is greatly appreciated. I am out of leads not sure what else to try.

Thanks in advanced.

Breakthrough

I have found a way of making it work. I am no longer using:

{ method: 'GET', isArray: false,

Instead, I am using:

{ method: 'OPTIONS', isArray: false,

In addition to the python code:

def options(self):

This has allowed me to send Authorization headers.

Answer 1

You must include:

    def options(self, *args, **kwargs):
      self.response.headers['Access-Control-Allow-Origin'] = '*'
      self.response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
      self.response.headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, DELETE'

Add this to your class, including your get.

What happens is that your request will look for options. Hense the error, "OPTIONS".