title: Method not allowed — removing Access-Control-Request-Method from request headers in Angularjs
body: <p>I'm currently trying a <code>DELETE</code> type of request with Angular <code>ngResource</code> on a Restful API located on another domain.
  <code>GET</code> and <code>PUT</code> work fine.
  <strong><code>DELETE</code> works in the Advanced Rest Client Chrome extension but doesn't work when tried with Angular <code>$resource</code>.</strong></p>
  
  <p>I have noticed a difference in the headers sent, which are these two:</p>
  
  <pre><code>Access-Control-Request-Headers:accept
  Access-Control-Request-Method:DELETE
  </code></pre>
  
  <p>When I try to add these two headers in Advanced Rest Client I get the following errors in the Chrome console:</p>
  
  <pre><code>Refused to set unsafe header "Access-Control-Request-Headers"
  Refused to set unsafe header "Access-Control-Request-Method"
  </code></pre>
  
  <p>Finally the server (which is normally configured to accept cross-domain requests), when I try the <code>DELETE</code> request with Angular, sends the following response (with status <code>200</code> and method use <code>OPTIONS</code>):</p>
  
  <pre><code>Access-Control-Allow-Headers:*
  Access-Control-Allow-Methods:*
  Access-Control-Allow-Origin:*
  Allow:PUT,DELETE
  Cache-Control:private, must-revalidate
  Connection:close
  Content-Length:0
  Content-Type:text/html; charset=UTF-8
  Date:Thu, 12 Feb 2015 12:08:47 GMT
  ETag:"d41d8cd98f00b204e9800998ecf8427e"
  Server:Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/0.9.8o DAV/2 PHP/5.5.20
  </code></pre>
  
  <p>But I get the error:</p>
  
  <pre><code>XMLHttpRequest cannot load [URL]. Method DELETE is not allowed by Access-Control-Allow-Methods.
  </code></pre>
  
  <p><strong>I suspect the first mentioned two headers to be the cause of the problem. Are they the problem and if yes how could I remove them?</strong></p>
  
  <hr>
  
  <p>If it can help, I tried configuring my <code>$httpProvider</code> (as seen in other questions/answers) and it currently looks like this:</p>
  
  <pre><code>delete $httpProvider.defaults.headers.common['X-Requested-With'];
  delete $httpProvider.defaults.headers.common['Access-Control-Request-Method'];
  delete $httpProvider.defaults.headers.common['Access-Control-Request-Headers'];
  $httpProvider.defaults.headers.post['Content-Type'] = 'application/x-www-form-urlencoded;charset=utf-8';
  </code></pre>