Resolved BugFix #993 (#996)

src/Ocelot/Authorisation/Middleware/AuthorisationMiddleware.cs

@@ -25,7 +25,7 @@
 
         public async Task Invoke(DownstreamContext context)
         {
-            if (IsAuthenticatedRoute(context.DownstreamReRoute))
+            if (!IsOptionsHttpMethod(context) && IsAuthenticatedRoute(context.DownstreamReRoute))
             {
                 Logger.LogInformation("route is authenticated scopes must be checked");
 
@@ -52,7 +52,7 @@
                 }
             }
 
-            if (IsAuthorisedRoute(context.DownstreamReRoute))
+            if (!IsOptionsHttpMethod(context) && IsAuthorisedRoute(context.DownstreamReRoute))
             {
                 Logger.LogInformation("route is authorised");
 
@@ -99,5 +99,10 @@
         {
             return reRoute.IsAuthorised;
         }
+
+        private static bool IsOptionsHttpMethod(DownstreamContext context)
+        {
+            return context.HttpContext.Request.Method.ToUpper() == "OPTIONS";
+        }
     }
 }