HttpInterceptor Tokens Leak on CORS requests and break CORS. about angular-token

[raysuelzer]

Not sure the best way to fix this, but the default configuration is insecure and breaks CORS requests where servers do not accept the headers which are being added to the request.

In my case, I cannot change the API base to a specific URL because we are deploying the same code across different subdomains. Also, setting the API base at runtime has implications for AOT compilation. I think the default configuration should be that if a request is to a host on a different domain that a flag has to be set to specifically enable CORS authentication. Alternatively, having a blob type check for whitelist and blacklisting of URLS might work.

Would be interested to hear the thoughts on this.