use Content-Language header for auth bearer

lee-b · Sep 14, 2017 · 595cf6c · 595cf6c
1 parent 4262e2c
commit 595cf6c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/app/config.js b/src/app/config.js
@@ -12,7 +12,8 @@ angular
         $qProvider.errorOnUnhandledRejections(false);
         $locationProvider.hashPrefix('');
         jwtOptionsProvider.config({
-            urlParam: 'access_token',
+            // Using Content-Language header since it is unused and is a CORS-safelisted header. This avoids pre-flights.
+            authHeader: 'Content-Language',
             whiteListedDomains: appSettings.whitelistDomains
         });
         var refreshPromise;