Why does the preflight OPTIONS request of an authenticated CORS request work in Chrome but not Firefox?

I am writing a JavaScript client to be included on 3rd party sites (think Facebook Like button). It needs to retrieve information from an API that requires basic HTTP authentication. The simplified setup looks like this: A 3rd party site includes this snippet on their page: <script async="true" id="web-dev-widget" data-public-key="pUbl1c_ap1k3y" src="http://web.dev/widget.js"> </script> widget.js

[katsuren]

CORSリクエストは事前リクエスト(OPTIONS)を送るが、preflightは明示的に認証情報を含めてはならないと定められているため、Basic認証は通すことができないのでリファラやOPTIONSメソッドの場合は認証不要な処理を実装する