# Set headers for https OPTIONS response when using 2 webhook node pattern

**URL:** <https://community.n8n.io/t/set-headers-for-https-options-response-when-using-2-webhook-node-pattern/34633>\
**Category:** Feature Requests\
**Tags:** node, webhook, respond-to-webhook\
**Created:** [December 28, 2023, 10:28am UTC](https://community.n8n.io/t/set-headers-for-https-options-response-when-using-2-webhook-node-pattern/34633 "2023-12-28T10:28:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![James-MVM](https://avatars.discourse-cdn.com/v4/letter/j/b4bc9f/32.png) [@James-MVM](https://community.n8n.io/u/James-MVM)\
**Post date:** [December 28, 2023, 10:28am UTC](https://community.n8n.io/t/set-headers-for-https-options-response-when-using-2-webhook-node-pattern/34633/1 "2023-12-28T10:28:37Z")

</div>

## The idea is:

When using a webhook trigger node with the response sent in a ‘respond-to-webhook’ putting headers in the first webhook trigger node could set response headers for pre-flight OPTIONS requests.

## My use case:

I am trying to use the Webhook + Respond To Webhook nodes to add some dynamic JSON data to a front end page hosted on another server.

If I set basic authentication to my requests on n8n cloud I can access these resources on firefox since it will set an authorisation header without doing a pre-flight OPTIONS request. Chrome however does the pre-flight OPTIONS request and doesn’t get back Authorization as an allowed header.

It might be sensible / easier to just have n8n cloud allow the Authorization header when responding to OPTIONS pre-flight requests. But it would give more flexibility & control to allow the arbitrary headers set on the Webhook node to control this response in the case where the response is controlled via the Respond to Webhook node.

## I think it would be beneficial to add this because:

## Any resources to support this?

> **[CORS - Glossary | MDN](https://developer.mozilla.org/en-US/docs/Glossary/CORS)**
>
> CORS (Cross-Origin Resource Sharing) is a system, consisting of transmitting HTTP headers, that determines whether browsers block frontend JavaScript code from accessing responses for cross-origin requests.

> **[Complete Guide to CORS](https://reflectoring.io/complete-guide-to-cors/)**
>
> CORS is a protocol and security standard for browsers that helps to maintain the integrity of a website and secure it from unauthorized access. In this article, we will understand cross-origin resource sharing (CORS) and describe some common examples...