title: 302 redirect after CORS preflight request to nodejs server
body: <p>I try to build a platform, which consists of 2 separated parts, the backend and the frontend.
  The backend is powered by Express.js and Passport.js. It's available via localhost:3000.
  The frontend uses Googles polymer-1.0 and is running on localhost:8001.</p>
  
  <p>I want to do all API stuff on my backend. The Ui calls and get data from the backend.</p>
  
  <p>When try to do an iron-ajax request for authorization to my backend route, I'm getting a CORS error:</p>
  
  <pre>XMLHttpRequest cannot load http://localhost:3000/auth/facebook.
  The request was redirected to 'https://www.facebook.com/v2.2/dialog/oauth?response_type=code&redirect_uri=…%3A3000%2Fauth%2Ffacebook%2Fcallback&scope=email&client_id=0815', 
  which is disallowed for cross-origin requests that require preflight.</pre>
  
  <p>UI snippet:</p>
  
  <pre>
  
  iron-ajax
     id="login"
     url=""
     method="GET"
     headers='{"X-Requested-With": "XMLHttpRequest"}'
     handle-as="json"
     on-response="hresponse"
     debounce-duration="300">
  /iron-ajax>
  
  
  _handleTap: function () {
     var url = 'http://localhost:3000/auth/' + this.service;
     this.$.login.url = url;
     this.$.login.generateRequest();      
  },
  </pre>
  
  <p>Backend snippet:</p>
  
  <pre>
  app.get('/auth/facebook', passport.authenticate('facebook', { scope: 'email' }));
  
  app.get('/auth/facebook/callback', passport.authenticate('facebook'), function(req, res) {
          res.status(200).json({
              success: true,
              message: 'Enjoy!',
              redirect: '/route/to/nowhere',
          }).end();
      });
  
  </pre>
  
  <p>As you can see, I'm just using the simple Facebook auth snippet from <a href="http://passportjs.org/docs/facebook" rel="noreferrer">passport.js documenation</a>.</p>
  
  <p>There were 2 request proceeded:
  PREFLIGHT:</p>
  
  <pre>
  RESPONSE
  HTTP/1.1 200 OK
  X-Powered-By: Express
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
  Allow: GET,HEAD
  Content-Type: text/html; charset=utf-8
  Content-Length: 8
  ETag: W/"8-8ww6QOmj5lyGjHVKXelZGQ"
  Date: Tue, 26 Jan 2016 12:59:20 GMT
  Connection: keep-alive
  
  REQUEST
  OPTIONS /auth/facebook HTTP/1.1
  Host: localhost:3000
  Connection: keep-alive
  Access-Control-Request-Method: GET
  Origin: http://localhost:8001
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
  Access-Control-Request-Headers: accept, x-requested-with
  Accept: */*
  DNT: 1
  Referer: http://localhost:8001/
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4
  </pre>
  
  <p>GET:</p>
  
  <pre>
  RESPONSE
  HTTP/1.1 302 Found
  X-Powered-By: Express
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
  Location: https://www.facebook.com/v2.2/dialog/oauth?response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Ffacebook%2Fcallback&scope=email&client_id=0815
  Content-Length: 0
  Date: Tue, 26 Jan 2016 12:59:20 GMT
  Connection: keep-alive
  
  REQUEST
  GET /auth/facebook HTTP/1.1
  Host: localhost:3000
  Connection: keep-alive
  accept: application/json
  Origin: http://localhost:8001
  x-requested-with: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
  DNT: 1
  Referer: http://localhost:8001/
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4
  </pre>
  
  <p>My node.js server also accepts CORS requests</p>
  
  <pre><code>app.use(function(req, res, next) {
      res.header('Access-Control-Allow-Origin', '*');
      res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
      next();
  });
  </code></pre>
  
  <p>When using localhost:3000/auth/facebook as a link, I get my json response from the backend and on port 3000, but that is not what I want.</p>
  
  <p>Is there a possibility to handle such API requests via an own API interface, like mine? Currently I see here a big show stopper.</p>
  
  <p>Thanks &amp; BR;
  andre</p>