title: AngularJS $http, CORS and http authentication
body: <p>Because using CORS and http authentication with AngularJS can be tricky I edited the question to share one learned lesson. First I want to thank igorzg. His answer helped me a lot. The scenario is the following: You want to send POST request to a different domain with AngularJS $http service. There are several tricky things to be aware of when getting AngularJS and the server setup. </p>
  
  <p>First: 
  In your application config you must allow cross domain call</p>
  
  <pre><code>/**
   *  Cors usage example. 
   *  @author Georgi Naumov
   *  gonaumov@gmail.com for contacts and 
   *  suggestions. 
   **/ 
  app.config(function($httpProvider) {
      //Enable cross domain calls
      $httpProvider.defaults.useXDomain = true;
  });
  </code></pre>
  
  <p>Second:
  You must specify withCredentials: true and username and password into 
  request.  </p>
  
  <pre><code> /**
    *  Cors usage example. 
    *  @author Georgi Naumov
    *  gonaumov@gmail.com for contacts and 
    *  suggestions. 
    **/ 
     $http({
          url: 'url of remote service',
          method: "POST",
          data: JSON.stringify(requestData),
          withCredentials: true,
          headers: {
              'Authorization': 'Basic bashe64usename:password'
          }
      });
  </code></pre>
  
  <p>Тhird:
   Server setup. You must provide:</p>
  
  <pre><code>/**
   *  Cors usage example. 
   *  @author Georgi Naumov
   *  gonaumov@gmail.com for contacts and 
   *  suggestions. 
   **/ 
  header("Access-Control-Allow-Credentials: true");
  header("Access-Control-Allow-Origin: http://url.com:8080");
  header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
  header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization");
  </code></pre>
  
  <p>For every request. When you receive OPTION you must pass:</p>
  
  <pre><code>/**
   *  Cors usage example. 
   *  @author Georgi Naumov
   *  gonaumov@gmail.com for contacts and 
   *  suggestions. 
   **/ 
  if($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
     header( "HTTP/1.1 200 OK" );
     exit();
  }
  </code></pre>
  
  <p>HTTP authentication and everything else comes after that.</p>
  
  <p>Here is complete example of usage of server side with php. </p>
  
  <pre><code>&lt;?php
  /**
   *  Cors usage example. 
   *  @author Georgi Naumov
   *  gonaumov@gmail.com for contacts and 
   *  suggestions. 
   **/ 
  header("Access-Control-Allow-Credentials: true");
  header("Access-Control-Allow-Origin: http://url:8080");
  header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
  header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization");
  
  if($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
     header( "HTTP/1.1 200 OK" );
     exit();
  }
  
  
  $realm = 'Restricted area';
  
  $password = 'somepassword';
  
  $users = array('someusername' =&gt; $password);
  
  
  if (isset($_SERVER['PHP_AUTH_USER']) == false ||  isset($_SERVER['PHP_AUTH_PW']) == false) {
      header('WWW-Authenticate: Basic realm="My Realm"');
  
      die('Not authorised');
  }
  
  if (isset($users[$_SERVER['PHP_AUTH_USER']]) &amp;&amp; $users[$_SERVER['PHP_AUTH_USER']] == $password) 
  {
      header( "HTTP/1.1 200 OK" );
      echo 'You are logged in!' ;
      exit();
  }
  ?&gt;
  </code></pre>
  
  <p>There is an article on my blog about this issue which can be seen <a href="http://georgi-naumov.blogspot.com/2014/02/angularjs-http-cors-and-http.html">here</a>.</p>