CORS Preflight Check Broken in API

[tlovett1]

In /wp-includes/rest-api/class-wp-rest-server.php line 237:

$this->send_header( 'Access-Control-Allow-Headers', 'Authorization' );

This is breaking CORS preflight checks and resulting in error messages in Chrome like this:

XMLHttpRequest cannot load https://corsdomain.com/wp-json/... Request header field X-WP-Nonce is not allowed by Access-Control-Allow-Headers in preflight response.

[rachelbaker]

Per @rmccue that merged the related code here: ​https://github.com/WP-API/WP-API/pull/1529

You shouldn't be able to send the nonce from a different origin so far as I can tell
Cookie authentication is intentionally limited by the nonce to the current site.

If you really need it, you can send multiple Access-Control-Allow-Headers headers, so hook into an early action (like rest_send_nocache_headers) and add extra ones

[rickharrison]

I am trying to hit my API from a javascript app and this hardcoded Access-Control-Allow-Headers is getting in the way. How do you customize this?