I have noticed that while using fetch that any CORS triggering request(post, put, delete,...) will fail because the OPTIONS preflight request sent by the browser lacks the OTCSTicket authorization header, as you can't add custom headers to a browser's preflight request. Without the header the OPTIONS response from the content server returns a 401 unauthorized. This is a problem because the actual PUT,POST,DELETE may return a 200 OK even though the OPTIONS is returning a 401 which means it will look like everything succeeded when in reality the browser blocked your PUT, POST, DELETE request and to make things even harder to diagnose, Chrome Dev Tools doesn't show the preflight request. I had to use Postman with the Interceptor on to even see the Options request and the subsequent 401 response.
I am pretty sure the fix for this is to NOT require the OTCSTicket on OPTIONS requests only. As OPTIONS will generally only be sent by the browser for preflight CORS verification. Unless someone has another way around this, it is making my life a living **** because it effectively breaks localhost development.
