title: Can't Send Authentication Header in Cross Origin Access Scenario
body: <p>I have cross origin communication enabled on my Node.js server so that my Vue application can access its API from an origin that is different from the origin where static assets are served.  This is done using the following code in Node.js:</p>
  <pre><code>res.setHeader('Access-Control-Allow-Origin', '*');
  </code></pre>
  <p>along with the following JavaScript code in Vue.:</p>
  <pre><code>fetch(url);
  </code></pre>
  <p>This worked fine until I introduced HTTP header based authentication.  With that authentication in place, the JavaScript code in Vue was changed from the above to:</p>
  <pre><code>fetch(url, {headers: {'Authorization': bearer}});
  </code></pre>
  <p>Once introducing the Authorization header, the browser began to receive the following error when trying to access the API:</p>
  <blockquote>
  <p>Access to fetch at 'https://localhost:8001/articles' from origin
  http://localhost:8080' has been blocked by CORS policy: Response to
  preflight request doesn't pass access control check: No
  'Access-Control-Allow-Origin' header is present on the requested
  resource. If an opaque response serves your needs, set the request's
  mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  </blockquote>
  <p>So, it would seem that introducing the HTTP Authorization header results in preflight requests that fail to pass the preflight test. This notion appears to be substantiated by the Mozilla docs:</p>
  <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin</a></p>
  <blockquote>
  <p>For requests <em><strong>without credentials</strong></em>, the literal value &quot;*&quot; can be
  specified, as a wildcard; the value tells browsers to allow requesting
  code from any origin to access the resource. Attempting to use the
  wildcard with credentials will result in an error.</p>
  </blockquote>
  <p>So, does this mean that HTTP header based authentication simply can not be implemented in scenario where requests are being made cross origin?</p>
  <p>More to the point, how can I implement HTTP header based authorization in my scenario?</p>