setRequestHeader不添加授权头

Question

我试图从JavaScript发送带有Authorization头一个HTTP POST，发现了很多的答案，建议此配置

var device_address = 10.25.148.164; 
var device_login = myusername; 
var device_password = mypassword; 
var xhr = new XMLHttpRequest(); 
xhr.open('POST', 'http://' + device_address + '/rest/conf', true); 
xhr.setRequestHeader('Authorization', 'Basic ' + btoa(device_login + ':' + device_password)); 
xhr.send(); 

以上的配置不适合我的工作，我也得到状态码401 ：未经授权”;从Wireshark的数据包捕获，我看到下面的

Hypertext Transfer Protocol 
OPTIONS /rest/conf HTTP/1.1\r\n 
    [Expert Info (Chat/Sequence): OPTIONS /rest/conf HTTP/1.1\r\n] 
     [OPTIONS /rest/conf HTTP/1.1\r\n] 
     [Severity level: Chat] 
     [Group: Sequence] 
    Request Method: OPTIONS 
    Request URI: /rest/conf 
    Request Version: HTTP/1.1 
Host: 10.25.148.164\r\n 
Connection: keep-alive\r\n 
Access-Control-Request-Method: POST\r\n 
Origin: http://10.120.22.225:3000\r\n 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36\r\n 
Access-Control-Request-Headers: authorization\r\n 
Accept: */*\r\n 
Referer: http://10.120.22.225:3000/myapp/1/edit?\r\n 
Accept-Encoding: gzip, deflate, sdch\r\n 
Accept-Language: en-US,en;q=0.8\r\n 
\r\n 
[Full request URI: http://10.25.148.164/rest/conf] 
[HTTP request 1/1] 
[Response in frame: 14] 

但是，如果我把从邮差它工作的POST，和Wireshark数据包捕获显示以下

Hypertext Transfer Protocol 
POST /rest/conf HTTP/1.1\r\n 
Host: 10.25.148.164\r\n 
Connection: keep-alive\r\n 
Content-Length: 0\r\n 
Accept: application/json\r\n 
Cache-Control: no-cache\r\n 
Origin: chrome-extension://fhbjgbiflinjbdggehcddcbncdddomop\r\n 
Authorization: Basic <original_string_removed_from_here>\r\n 
    Credentials: myusername:mypassword 
Content-Type: application/json\r\n 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36\r\n 
Postman-Token: 4ec1726d-dced-eede-625b-17f9b8f3e0fe\r\n 
Accept-Encoding: gzip, deflate\r\n 
Accept-Language: en-US,en;q=0.8\r\n 
\r\n 
[Full request URI: http://10.25.148.164/rest/conf] 
[HTTP request 1/1] 
[Response in frame: 19] 

我试过window.btoa代替BTOA，我尝试添加

xhr.setRequestHeader('Content-Type', 'application/json'); 
xhr.setRequestHeader('Accept', 'application/json'); 

，但毫无效果。

任何人都可以告诉我我错过了什么？

更新1

我用了一个临时服务器并启用访问控制允许来源：*，但反应仍然是401未授权

Hypertext Transfer Protocol 
HTTP/1.1 401 Unauthorized\r\n 
    [Expert Info (Chat/Sequence): HTTP/1.1 401 Unauthorized\r\n] 
     [HTTP/1.1 401 Unauthorized\r\n] 
     [Severity level: Chat] 
     [Group: Sequence] 
    Request Version: HTTP/1.1 
    Status Code: 401 
    Response Phrase: Unauthorized 
Access-Control-Allow-Origin: *\r\n 
Content-Type: application/json\r\n 
Vyatta-Specification-Version: 0.3\r\n 
Cache-Control: no-cache\r\n 
Content-Length: 47\r\n 
    [Content length: 47] 
Date: Sat, 10 Dec 2016 02:25:48 GMT\r\n 
Server: lighttpd/1.4.35\r\n 
\r\n 
[HTTP response 1/1] 
[Time since request: 0.000526000 seconds] 
[Request in frame: 19] 
File Data: 47 bytes 

JavaScript对象符号：应用/ JSON

Answer 1

这是一个跨源的浏览器请求，如果是的话，这将作为安全措施被阻止，你从哪里发起请求我可以得到的URL和任何其他数据可能是有用的和对不起张贴此作为一个答案不能发表评论，希望这是有益的

PS-如果你有一个临时的URL从那里试试吧上传代码后，可能工作