title: How to CORS-enable Apache web server (including preflight and custom headers)?
body: <p>General:</p>
  
  <pre><code>Request URL:x/site.php
  Request Method:OPTIONS
  Status Code:302 Found
  Remote Address:x.x.x.x:80
  </code></pre>
  
  <p>Response Headers:</p>
  
  <pre><code>view source
  Access-Control-Allow-Headers:Content-Type
  Access-Control-Allow-Origin:*
  Access-Control-Max-Age:300
  Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Length:0
  Content-Type:text/html; charset=UTF-8
  Date:Thu, 02 Mar 2017 14:27:21 GMT
  Expires:Thu, 19 Nov 1981 08:52:00 GMT
  Location:y
  Pragma:no-cache
  Server:Apache/2.4.25 (Ubuntu)
  </code></pre>
  
  <p>Request Headers:</p>
  
  <pre><code>view source
  Accept:*/*
  Accept-Encoding:gzip, deflate, sdch
  Accept-Language:en-US,en;q=0.8
  Access-Control-Request-Headers:authorization
  Access-Control-Request-Method:POST
  Cache-Control:no-cache
  Connection:keep-alive
  DNT:1
  Host:x
  Origin:http://127.0.0.1:3000
  Pragma:no-cache
  Referer:http://127.0.0.1:3000/
  User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.90 Safari/537.36
  </code></pre>
  
  <p>Apache virtualhost config looks as so:</p>
  
  <pre><code>    &lt;IfModule mod_headers.c&gt;
             Header set Access-Control-Allow-Origin "http://127.0.0.1:3000"
             Header set Access-Control-Allow-Origin "http://127.0.0.1"
             Header set Access-Control-Max-Age "300"
             Header set Access-Control-Allow-Credentials "true"
             Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept"
             Header set Access-Control-Allow-Methods "POST, GET, PUT, DELETE, PATCH, OPTIONS"
      &lt;/IfModule&gt;
  </code></pre>
  
  <p>The preflight request is skipping the apache config and hitting my webapp directly, which does a redirect (hence the 302 and the location: y).</p>
  
  <p>I don't know why the preflight request is not being handled by apache?</p>