Web Development
Bug Report
CORS preflight fails after adding an Authorization header behind nginx
Moving our SPA from cookie auth to bearer tokens broke every API call with a CORS error. The Authorization header triggered an OPTIONS preflight, our nginx auth check rejected it, and error responses carried no CORS headers.