title: CORS errors with Symfony 4 & Nelmio CORS Bundle
body: <p>I've been trying to figure out why I'm getting CORS issues with my Symfony 4 API application I've just deployed to my Apache server and can't make any sense of the issue.</p>
  
  <p><strong>config/packages/nelmio_cors.yaml</strong></p>
  
  <pre><code>nelmio_cors:
      defaults:
          origin_regex: true
          allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
          allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
          allow_headers: ['Content-Type', 'Authorization']
          max_age: 3600
      paths:
          '^/': ~
  </code></pre>
  
  <p><strong>.env</strong></p>
  
  <pre><code>...
  CORS_ALLOW_ORIGIN=/*/
  ...
  </code></pre>
  
  <p>All responses from requests I make from my <code>localhost</code> front-end application to that API contain no <code>Access-Control-Allow-Origin</code> header, and I get the standard error;</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://my-api.com/foo" rel="noreferrer">http://my-api.com/foo</a>' from origin
    '<a href="http://localhost:4200" rel="noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Response to
    preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource.</p>
  </blockquote>
  
  <p>No special headers are being sent and for now I've set the allowed origin regex to "all" so I can't work out what is causing issue here. I've even checked within the cache to ensure the origin is being correctly pulled from the env variables, which it is. If other context/file content is required to assist please let me know!</p>