allow ajax requests to work with basic http auth

To securize access to Elasticsearch with http basic authentication you need two things to avoid this error :

XMLHttpRequest cannot load http://xxx.tld:9200 No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://xxx.tld' is therefore not allowed access.

1 - Add proper Access-Control-Allow- headers to your proxy configuration

<VirtualHost *:9200>
        ServerName xxx.tld

        DocumentRoot /var/www/jail

        SSLEngine on
        SSLCertificateFile      /etc/apache2/ssl/cert.crt
        SSLCertificateKeyFile   /etc/apache2/ssl/cert.key
        SSLCACertificateFile    /etc/apache2/ssl/cert.chain

        ProxyRequests Off
        ProxyPreserveHost On
        ProxyPass / http://xxx.xxx.xxx.xxx:9200/
        ProxyPassReverse / http://xxx.xxx.xxx.xxx:9200/

        <Proxy *>
                AuthType Basic
                AuthBasicProvider file
                AuthUserFile /etc/apache2/.htpasswd
                require valid-user

                Header set Access-Control-Allow-Origin  "https://xxx.tld" #Wildcard will not work here
                Header set Access-Control-Allow-Methods "GET, OPTIONS"
                Header set Access-Control-Allow-Credentials true

                Order deny,allow
                allow from all
        </Proxy>
</VirtualHost>

2 - Make $http to send cross domain requests with credentials 

set $httpProvider.defaults.withCredentials to true in app.config();