title: AJAX access to node API behind basic auth provided by proxy
body: <p>I get a plain API written in node.js such as this one:</p>
  
  <pre><code>const express = require('express')
  const app = express();
  
  app.post('/api/data', (req, res) =&gt; {
    res.status(200).json({
      data: [1,2,3,3,1,3,5,2,3,4,4,7]
    })
  })
  
  app.use('/gui', express.static('./gui'))
  
  app.listen(8080, () =&gt; { console.log("OK") })
  </code></pre>
  
  <p>and a client javascript code accessing it with the <code>fetch</code> function, this way (e.g. <code>./gui/index.html</code>):</p>
  
  <pre><code>fetch('/api/data', {
    method: 'post',
    headers: {
      'Accept': 'application/json', 'Content-Type': 'application/json'
    },
    body: JSON.stringify(json)
  })
  .then( res =&gt; { console.log(res })
  </code></pre>
  
  <p>It works fine, but now I want to put this API behind basic auth without changing the API code using nginx as man in the middle. The config file looks like:</p>
  
  <pre><code>server {
    listen 80;
  
    location / {
      auth_basic "Private Area";
      auth_basic_user_file .htpasswd; 
  
      proxy_pass http://localhost:8080;
      proxy_set_header   Host             $host;
      proxy_set_header   X-Real-IP        $remote_addr;
    }
  }
  </code></pre>
  
  <p>Now, when I open the page in the browser, it asks for the auth infos, displays the HTML, but the AJAX accesses fail with a 401 error.</p>
  
  <p>After checking it looks like the browser does not send the Authorization headers for the AJAX accesses.</p>
  
  <p>The question is: is there a way to make the basic auth transparent to my API and GUI? I am doing something wrong?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>It has been suggested that this question is a duplicate of <a href="https://stackoverflow.com/questions/43842793">Basic authentication with fetch?</a></p>
  
  <p>I know how to set the headers explicitly to fetch. What I want here is the browser to set them implicitly when the application is behind basic auth, without any modification to my client code.</p>