title: OAuth2 - Status 401 on OPTIONS request while retrieving TOKEN
body: <p>Our stack uses Backbone as our client-side app and Spring Boot as a RESTful API.</p>
  
  <p>We're trying to make basic authentication using OAuth2 with user providing username and password.</p>
  
  <p>We use Spring Security for authentication and jQuery $.ajax method for making requests. However the response we get is 401(unauthorized) status on preflight OPTIONS request before we can even POST header with our secret to authorize.
  However we can POST or GET any other resource without any problems. Server response for OPTIONS request is 200(ok) and then it follows up with POST request.</p>
  
  <p>So why is that an OPTIONS request from /oauth/token responses with 401 status even when it shouldn't? It won't let us authorize ourselves because it get's stuck at OPTIONS request in which we can't add authorization header.</p>
  
  <p>This is how we handle requests on front-end:</p>
  
  <pre><code>                $.ajax({
                  url: "http://localhost:8080/oauth/token",
                  type: "POST",
                  beforeSend: function(xhr) { 
                      xhr.setRequestHeader("Authorization", "Basic Y2xpZW50YXBwOjEyMzQ1Ng==");
                  },
                  data: {
                      password: "qwerty",
                      username: "jkowalski",
                      grant_type: "password"
                  }
              });
  </code></pre>
  
  <p>This is our OAuth2 config:</p>
  
  <pre><code>@Configuration
  public class OAuth2ServerConfiguration {
  
  private static final String RESOURCE_ID = "restservice";
  
  @Configuration
  @EnableResourceServer
  protected static class ResourceServerConfiguration extends
          ResourceServerConfigurerAdapter {
  
      [...]
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
  
          http
          .authorizeRequests()
              .anyRequest().permitAll();
      }
  
  }
  
  [...]
  
  @Configuration
  @EnableAuthorizationServer
  protected static class OAuth2AuthorizationConfig extends
          AuthorizationServerConfigurerAdapter {
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          // @formatter:off
          clients
              .inMemory()
                  .withClient("clientapp")
                      .authorizedGrantTypes("password", "refresh_token")
                      .authorities("USER","ADMIN")
                      .scopes("read", "write")
                      .resourceIds(RESOURCE_ID)
                      .secret("123456");
          // @formatter:on
      }
  
  [...]
  }
  </code></pre>