Juju API calls don't support CORS requests with OPTIONS

[Jeff Pihach]

When attempting to discharge a login macaroon over http the preceding OPTIONS call is rejected with a 405. The OPTIONS requests to the login endpoints to not seem to be supported: https://github.com/juju/juju/blob/df7d6fde8fa0a212ef53a5ac24952b0cebcfd864/apiserver/stateauthenticator/locallogin.go#L53

[Jeff Pihach (hatch)]

To expand on this, the endpoints need to be able to support CORS requests from the Juju Dashboard.

[Richard Harding (rharding)]

We looked and not sure we need this at the moment. If we go through and support CORS requests with OPTIONS we should look to do this globally in a better fashion. Marking as wishlist and renaming towards total CORS support for now.

[Canonical Juju QA Bot (juju-qa-bot)]

This bug has not been updated in 2 years, so we're marking it Low importance. If you believe this is incorrect, please update the importance.

[Huw Wilkins (huwshimi)]

This is still an issue for the dashboard. This is to support discharging a login macaroon vs user/pass authentication. There are two reasons this would be good for the Dashboard:

1. At the moment any visit to the dashboard or refreshing the page requires the user to log in again.

2. The dashboard supports adding additional controller which requires storing the username and password in local storage, with macaroon auth we wouldn't need to keep hold of the user's creds.