[Django]-'Request header field Authorization is not allowed' error – Tastypie

Antyrat’s answer is not complete.

You have to specify which headers your server allows; in your case Authorization.

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Authorization

Although I upvoted the answer of @Manuel Bitto,

I would like to post another answer which contains a complete Cors Filter that works for me with Apache tomcat 5.x:

public class CorsFilter implements Filter {

    public CorsFilter() { }

    public void init(FilterConfig fConfig) throws ServletException { }

    public void destroy() { }

    public void doFilter(

            ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        HttpServletResponse httpServletResponse = (HttpServletResponse)response;
        httpServletResponse.addHeader("Access-Control-Allow-Origin", "*");
        httpServletResponse.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS, DELETE");
        httpServletResponse.addHeader("Access-Control-Allow-Headers", "Authorization");

        chain.doFilter(request, response);
    }
}

I would suggest to specifically pay attention to the addition of OPTIONS to to the “Access-Control-Allow-Methods” header values.

The reason for doing that is that according to the explanation provided here by Mozilla,

if your request (let’s say POST) contains a special header, or content type (and this is my case), then the XMLHttpRequest object will generate an additional OPTIONS call, which you need to address in your code.

I hope this helps.

The problem was that www.domain.com was seen as different than domain.com.
domain.com worked, but when I used www.domain.com, it detected me as doing requests from a different domain

I know this question is older.

But today I ran into same cors issue after adding owin. After number of search on google and trying various solutions. I solved cors issue by adding below

<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />

For more details please follow the below links. Thanks.

[http://benfoster.io/blog/aspnet-webapi-cors]