Hi Pedro,

AeroGear Controller already supports CORS, so you don't need to worry about it.

+1 for provide some configurable at web.xml or something like (is just an idea and far from a perfect code):

AuthenticationFilter.java

        boolean hasOptionsEnabled = request.getMethod().equalsIgnoreCase("options");
        
        if (!identity.isLoggedIn() && !hasOptionsEnabled) {
            authenticationScheme.extractCredential(request, creds);

            if (creds.getCredential() != null) {
                identity.login();
            }
        }

Wdyt?

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira