{"action":"created","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/1568","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/1568/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/1568/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/1568/events","html_url":"https://github.com/mholt/caddy/issues/1568","id":220281992,"number":1568,"title":"Caddy does not respond correctly to preflight requests with basic authorization","user":{"login":"matthias-k","id":4093707,"avatar_url":"https://avatars3.githubusercontent.com/u/4093707?v=4","gravatar_id":"","url":"https://api.github.com/users/matthias-k","html_url":"https://github.com/matthias-k","followers_url":"https://api.github.com/users/matthias-k/followers","following_url":"https://api.github.com/users/matthias-k/following{/other_user}","gists_url":"https://api.github.com/users/matthias-k/gists{/gist_id}","starred_url":"https://api.github.com/users/matthias-k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthias-k/subscriptions","organizations_url":"https://api.github.com/users/matthias-k/orgs","repos_url":"https://api.github.com/users/matthias-k/repos","events_url":"https://api.github.com/users/matthias-k/events{/privacy}","received_events_url":"https://api.github.com/users/matthias-k/received_events","type":"User","site_admin":false},"labels":[{"id":165906141,"url":"https://api.github.com/repos/mholt/caddy/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-04-07T17:44:05Z","updated_at":"2018-03-26T18:18:54Z","closed_at":null,"author_association":"NONE","body":"\r\n### 1. What version of Caddy are you running (`caddy -version`)?\r\n\r\nCaddy 0.9.5 with the cors addon downloaded from the caddy website on debian testing 64bit.\r\n\r\n### 2. What are you trying to do?\r\n\r\nI am trying to serve an API with caddy using basic authorization. The frontend (using ember.js) access the API with CORS  with preflight requests and the basic authorization. However, caddy responds to the preflight requests with 401 if the request does not contain the authorization header (which you are not allowed to send in the preflight request: [CORS spec](https://www.w3.org/TR/cors/#preflight-request)). If I add the authorization header (which I am actually not allowed to do), then caddy responds correctly. In the following I show a minimal example which does not use a reverse proxy but instead just serves the local directory.\r\n\r\n### 3. What is your entire Caddyfile?\r\n```text\r\nlocalhost:8080 {\r\n    log access.log\r\n    errors errors.log\r\n    basicauth / user pass\r\n    cors\r\n}\r\n```\r\n\r\n### 4. How did you run Caddy (give the full command and describe the execution environment)?\r\n\r\nI run caddy using `./caddy` in the directoy where the caddy file and an `index.html` are present.\r\n\r\n### 5. Please paste any relevant HTTP request(s) here.\r\n\r\nThis is the correct preflight request:\r\n\r\n```\r\n$ curl -v 'http://localhost:8080' -X OPTIONS -H 'access-control-request-method: GET' -H 'origin: http://localhost:4200' -H 'access-control-request-headers: authorization'                                        \r\n* Rebuilt URL to: http://localhost:8080/\r\n*   Trying ::1...\r\n* TCP_NODELAY set\r\n* Connected to localhost (::1) port 8080 (#0)\r\n> OPTIONS / HTTP/1.1\r\n> Host: localhost:8080\r\n> User-Agent: curl/7.52.1\r\n> Accept: */*\r\n> access-control-request-method: GET\r\n> origin: http://localhost:4200\r\n> access-control-request-headers: authorization\r\n> \r\n< HTTP/1.1 401 Unauthorized\r\n< Content-Type: text/plain; charset=utf-8\r\n< Server: Caddy\r\n< Www-Authenticate: Basic realm=\"Restricted\"\r\n< X-Content-Type-Options: nosniff\r\n< Date: Fri, 07 Apr 2017 17:37:42 GMT\r\n< Content-Length: 17\r\n< \r\n401 Unauthorized\r\n* Curl_http_done: called premature == 0\r\n```\r\n\r\nAnd this is the incorrect preflight request which includes the authorization header:\r\n\r\n```\r\n$curl -v 'http://localhost:8080' -X OPTIONS -H 'access-control-request-method: GET' -H 'origin: http://localhost:4200' -H 'access-control-request-headers: authorization'  -H \"Authorization: Basic dXNlcjpwYXNz\"\r\n* Rebuilt URL to: http://localhost:8080/\r\n*   Trying ::1...\r\n* TCP_NODELAY set\r\n* Connected to localhost (::1) port 8080 (#0)\r\n> OPTIONS / HTTP/1.1\r\n> Host: localhost:8080\r\n> User-Agent: curl/7.52.1\r\n> Accept: */*\r\n> access-control-request-method: GET\r\n> origin: http://localhost:4200\r\n> access-control-request-headers: authorization\r\n> Authorization: Basic dXNlcjpwYXNz\r\n> \r\n< HTTP/1.1 200 OK\r\n< Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE\r\n< Access-Control-Allow-Origin: http://localhost:4200\r\n< Server: Caddy\r\n< Vary: Origin\r\n< Date: Fri, 07 Apr 2017 17:38:47 GMT\r\n< Content-Length: 0\r\n< Content-Type: text/plain; charset=utf-8\r\n< \r\n* Curl_http_done: called premature == 0\r\n* Connection #0 to host localhost left intact\r\n```\r\n\r\n### 6. What did you expect to see?\r\n\r\nAs far as I know, the first request (excluding the credentials) should be answered as the second request with 200 and an empty response body.\r\n\r\n### 7. What did you see instead (give full error messages and/or log)?\r\n\r\nSee above: caddy responds with 401\r\n\r\n### 8. How can someone who is starting from scratch reproduce the bug as minimally as possible?\r\n\r\nSee above: Serve a directory with caddy with basic authorization and try to send an `OPTIONS` preflight request with does not include the credentials but indicates their presence via `access-control-request-headers: authorization`. In my actual example, caddy acts as a reverse proxy for a python backend but that doesn't affect the problem."},"comment":{"url":"https://api.github.com/repos/mholt/caddy/issues/comments/376262566","html_url":"https://github.com/mholt/caddy/issues/1568#issuecomment-376262566","issue_url":"https://api.github.com/repos/mholt/caddy/issues/1568","id":376262566,"user":{"login":"ramigg","id":333731,"avatar_url":"https://avatars2.githubusercontent.com/u/333731?v=4","gravatar_id":"","url":"https://api.github.com/users/ramigg","html_url":"https://github.com/ramigg","followers_url":"https://api.github.com/users/ramigg/followers","following_url":"https://api.github.com/users/ramigg/following{/other_user}","gists_url":"https://api.github.com/users/ramigg/gists{/gist_id}","starred_url":"https://api.github.com/users/ramigg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ramigg/subscriptions","organizations_url":"https://api.github.com/users/ramigg/orgs","repos_url":"https://api.github.com/users/ramigg/repos","events_url":"https://api.github.com/users/ramigg/events{/privacy}","received_events_url":"https://api.github.com/users/ramigg/received_events","type":"User","site_admin":false},"created_at":"2018-03-26T18:18:53Z","updated_at":"2018-03-26T18:18:53Z","author_association":"NONE","body":"Is there any advance with that?\r\nthanks"}}
{"actor":{"display_login":"ramigg"}}