# Unable to send additional headers to companion with AwsS3Multipart

**URL:** <https://community.transloadit.com/t/unable-to-send-additional-headers-to-companion-with-awss3multipart/15094>\
**Category:** Uppy\
**Created:** [October 22, 2019, 9:54am UTC](https://community.transloadit.com/t/unable-to-send-additional-headers-to-companion-with-awss3multipart/15094 "2019-10-22T09:54:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![huydod](https://avatars.discourse-cdn.com/v4/letter/h/54ee81/32.png) [@huydod](https://community.transloadit.com/u/huydod)\
**Post date:** [October 22, 2019, 9:54am UTC](https://community.transloadit.com/t/unable-to-send-additional-headers-to-companion-with-awss3multipart/15094/1 "2019-10-22T09:54:28Z")

</div>

I have an express app using @uppy/companion as a middleware and I want to add JWT for authentication.

But I can’t send the Authorization header from the client and can’t figure out why. Please help me out.

I’ve tried both configuration properties **serverHeaders** and **companionHeaders** but none of them works. Here my uppy configuration on client side.

```
const uppy = new Core({
  autoProceed: true,
  debug: true,
})
  .use(AwsS3Multipart, {
    companionUrl: 'http://localhost:3001/',
    serverHeaders: {
      Authorization: 'Basic jfawoiejfoawejifj',
    },
    companionHeaders: {
      Authorization: 'Basic jfawoiejfoawejifj',
    },
  })
```

---

<div class="post-metadata">

**Author:** ![huydod](https://avatars.discourse-cdn.com/v4/letter/h/54ee81/32.png) [@huydod](https://community.transloadit.com/u/huydod)\
**Post date:** [October 22, 2019, 10:20am UTC](https://community.transloadit.com/t/unable-to-send-additional-headers-to-companion-with-awss3multipart/15094/2 "2019-10-22T10:20:57Z")

</div>

I’ve figured it out. I missed some configuration for CORS from the companion server.

It must allow options method, allow additional headers in **Access-Control-Allow-Headers** and expose it for options method

here my solution

```
app.use(cors({
  methods: ['OPTIONS', 'GET', 'POST', 'PATCH', 'PUT'],
  allowedHeaders: ['Content-Type', 'Authorization', 'Uppy-Versions', 'Accept'],
  exposedHeaders: ['Access-Control-Allow-Headers'],
}));
```