title: CORS and HTTP basic auth
body: <p>How would a preflighted HTTP request look like if you include Basic auth? Like the following conversation? Im having trouble to understand which headers need to be sent where, also because its not possible to debug it properly with Firebug</p>
  
  <p>Client:</p>
  
  <pre><code>OPTIONS /api/resource HTTP/1.1
  Access-Control-Request-Method: GET
  Origin: http://jsconsole.com
  </code></pre>
  
  <p>Server:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, PUT, DELETE
  Access-Control-Allow-Headers: Authorization
  Access-Control-Max-Age: 1728000
  Access-Control-Allow-Credentials: true
  </code></pre>
  
  <p>Client:</p>
  
  <pre><code>GET /api/resource HTTP/1.1
  Access-Control-Request-Method: GET
  Access-Control-Allow-Credentials: true
  Origin: http://jsconsole.com
  </code></pre>
  
  <p>Server:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, PUT, DELETE
  Access-Control-Allow-Headers: Authorization
  Access-Control-Max-Age: 1728000
  Access-Control-Allow-Credentials: true
  WWW-Authenticate: Basic realm="Authorisation Required"
  </code></pre>
  
  <p>Client:</p>
  
  <pre><code>GET /api/resource HTTP/1.1
  Access-Control-Allow-Credentials: true
  Authorization: Basic base64encodedUserAndPassword
  Access-Control-Request-Method: GET
  Origin: http://jsconsole.com
  </code></pre>
  
  <p>Server:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, PUT, DELETE
  Access-Control-Allow-Headers: Authorization
  Access-Control-Max-Age: 1728000
  Access-Control-Allow-Credentials: true
  </code></pre>