title: A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' Even though it's not a wildcard
body: <p>Hello I am experiencing a strange bug with PHP and marionette.js. I have a frontend made of marionette.js (extending backbone.js) which needs to do CORS calls to my backend API running slim on another URL. I've overriden backbone's sync function to allow withCredentials and stuff :</p>
  
  <pre><code>var proxiedSync = Backbone.sync;
  
    Backbone.sync = function(method, model, options) {
      options || (options = {});
  
      if (!options.crossDomain) {
        options.crossDomain = true;
      }
  
      if (!options.xhrFields) {
        options.xhrFields = {withCredentials:true};
      }
  
      return proxiedSync(method, model, options);
    };
  </code></pre>
  
  <p>In my Slim 3.5 backend I have this middleware setup for my CORS headers :</p>
  
  <pre><code>$app-&gt;add(function ($req, $res, $next) {
  $response = $next($req, $res);
  return $response-&gt;withHeader('Access-Control-Allow-Credentials', 'false')-&gt;withHeader('Access-Control-Allow-Origin', 'http://localhost:4000')
          -&gt;withHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization, Session')
          -&gt;withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD');});
  </code></pre>
  
  <p>Now I have the current response in chrome debug tool : </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load xxxxx. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin '<a href="http://localhost:4000" rel="nofollow">http://localhost:4000</a>' is therefore not allowed access. The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>However when I look at the Network tab and examine the Request Headers, I can clearly see that the Access-Control-Allow-Origin is not a wildcard, but '<a href="http://localhost:4000" rel="nofollow">http://localhost:4000</a>' :</p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Fri, 09 Sep 2016 17:35:32 GMT
  Server: Apache/2.4.17 (Win64) PHP/7.0.0
  X-Powered-By: PHP/7.0.0
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: http://localhost:4000
  Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept, Origin, Authorization, Session
  Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
  Content-Length: 1130
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Content-Type: text/html; charset=UTF-8
  </code></pre>
  
  <p><strong>EDIT 1 : HERE'S MY OPTIONS ROUTE</strong></p>
  
  <p>Here is my Options Route in slim :</p>
  
  <pre><code>$app-&gt;options('/{routes:.+}', function ($request, $response, $args) {
      return $response;
  });
  </code></pre>
  
  <p><strong>EDIT 2 : PRE FLIGHT RESPONSE AND REQUEST</strong></p>
  
  <p>Ok so here is a quick update with the preflight response Request Headers :</p>
  
  <pre><code>OPTIONS /devsea/login HTTP/1.1
  Host: localhost
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  Access-Control-Request-Method: POST
  Origin: http://localhost:4000
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
  Access-Control-Request-Headers: content-type
  Accept: */*
  Referer: http://localhost:4000/
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8,fr;q=0.6
  </code></pre>
  
  <p>Here is the response headers to the pre-flight request :</p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Fri, 16 Sep 2016 00:49:38 GMT
  Server: Apache/2.4.17 (Win64) PHP/5.6.16
  X-Powered-By: PHP/5.6.16
  Set-Cookie: UserSession=aemsvqf9b7u2c4isdhocq4mre7; expires=Fri, 16-Sep-2016 01:49:38 GMT; Max-Age=3600; path=/
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: http://localhost:4000
  Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept, Origin, Authorization, Session
  Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, HEAD
  Content-Length: 0
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Content-Type: text/html; charset=UTF-8
  </code></pre>