web applications - CORS and HTTP basic auth -

how preflighted http request if include basic auth? following conversation? im having trouble understand headers need sent where, because not possible debug firebug

client:

options /api/resource http/1.1 access-control-request-method: origin: http://jsconsole.com 

server:

http/1.1 200 ok access-control-allow-origin: * access-control-allow-methods: post, get, put, delete access-control-allow-headers: authorization access-control-max-age: 1728000 access-control-allow-credentials: true 

client:

get /api/resource http/1.1 access-control-request-method: access-control-allow-credentials: true origin: http://jsconsole.com 

server:

http/1.1 401 unauthorized access-control-allow-origin: * access-control-allow-methods: post, get, put, delete access-control-allow-headers: authorization access-control-max-age: 1728000 access-control-allow-credentials: true www-authenticate: basic realm="authorisation required" 

client:

get /api/resource http/1.1 access-control-allow-credentials: true authorization: basic base64encodeduserandpassword access-control-request-method: origin: http://jsconsole.com 

server:

http/1.1 200 ok access-control-allow-origin: * access-control-allow-methods: post, get, put, delete access-control-allow-headers: authorization access-control-max-age: 1728000 access-control-allow-credentials: true 

if you're requesting credentials server must respond specific origin in access-control-allow-origin response header (and can't use wildcard *). of course need respond access-control-allow-credentials response header too.