title: Is it safe to ignore Authentication for all HTTP.OPTIONS calls?
body: <p>I have a cross origin request to my service. The service expects a "Authentication" header to be a token.</p>
  
  <p>The web client uses angularjs interceptor to pass the Authorization token, but gets </p>
  
  <p><code>OPTIONS http://&lt;domain&gt;:&lt;port&gt;/xxxx 401 (Unauthorized)</code><br>
  <code>XMLHttpRequest cannot load http://&lt;domain&gt;:&lt;port&gt;/xxxx. Response for preflight has invalid HTTP status code 401</code></p>
  
  <p>And hence, couldn't get the <code>Access-Control-Allow-Headers : Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With</code>  as the response. So the <code>Authorization</code> header in the following <code>GET</code> call is ignored!</p>
  
  <p>But when i disabled the authentication for the <code>OPTIONS</code> method -- i added a <code>antMatchers(HttpMethod.OPTIONS,"/**").permitAll()</code> -- 
   the web app was able to send <code>Authorization</code> header as expected. </p>
  
  <p>Is it safe to have non-authenticated calls for all <code>HTTP.OPTIONS</code> method in my service? </p>
  
  <p>Related question : <a href="https://stackoverflow.com/questions/21696592/disable-spring-security-for-options-http-method">Disable Spring Security for OPTIONS Http Method</a> </p>