# Request header field cache-control is not allowed by Access-Control-Allow-Headers in preflight response

**URL:** <http://forum.companieshouse.gov.uk/t/request-header-field-cache-control-is-not-allowed-by-access-control-allow-headers-in-preflight-response/1493>\
**Category:** API Issues\
**Created:** [December 1, 2017, 2:54pm UTC](http://forum.companieshouse.gov.uk/t/request-header-field-cache-control-is-not-allowed-by-access-control-allow-headers-in-preflight-response/1493 "2017-12-01T14:54:48Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![voracityemail](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/v/b77776/32.png) [@voracityemail](http://forum.companieshouse.gov.uk/u/voracityemail)\
**Post date:** [December 7, 2017, 1:12pm UTC](http://forum.companieshouse.gov.uk/t/request-header-field-cache-control-is-not-allowed-by-access-control-allow-headers-in-preflight-response/1493/5 "2017-12-07T13:12:39Z")

</div>

Hmm… I guess your code is slightly schematic as I’m surprised it worked at all as listed (although I’m not an expert on jQuery ajax function!). I think all you need in the _settings_ object is:

```
var settings = { "async": true,
  "crossDomain": true,
  "url": "https://api.companieshouse.gov.uk/company/06715377",
  "method": "GET",
  "headers": {
      "Authorization": "Basic " + btoa( " ****my key*****" + ":" ),
  },
}

```

That last part is showing that you’re using http “basic” authentication with a base-64 encoded username:password string (e.g. empty password as CH only supply username) as per:

> [@Jquery Ajax Get request](http://forum.aws.chdev.org/t/jquery-ajax-get-request/69/10):
>
> Authorization line should read: Authorization Basic mykey:

( atob() function documented at [Base64 - MDN Web Docs Glossary: Definitions of Web-related terms | MDN](https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding))

Chris

---

_[View the full topic](http://forum.companieshouse.gov.uk/t/request-header-field-cache-control-is-not-allowed-by-access-control-allow-headers-in-preflight-response/1493)._