title: Yii2 cors filters error that No 'Access-Control-Allow-Origin' header is present
body: <p>Following <a href="https://stackoverflow.com/questions/35359365/yii2-rest-angular-cross-domain-cors">This question</a> i have set my rest controller behaviour as</p>
  
  <pre><code>public function behaviors()
  {
      $behaviors = parent::behaviors();
  
      $auth= $behaviors['authenticator'] = [
          'class' =&gt; HttpBearerAuth::className(),
          'only' =&gt; ['dashboard'],
      ];
      $behaviors['contentNegotiator'] = [
          'class' =&gt; ContentNegotiator::className(),
          'formats' =&gt; [
              'application/json' =&gt; Response::FORMAT_JSON,
          ],
      ];
      $acces=$behaviors['access'] = [
          'class' =&gt; AccessControl::className(),
          'only' =&gt; ['login'],
          'rules' =&gt; [
              [
                  'actions' =&gt; ['login'],
                  'allow' =&gt; true,
                  'roles' =&gt; ['?'],
              ],
          ],
      ];
  
      unset($behaviors['authenticator']);
      unset($behaviors['access']);
  </code></pre>
  
  <p>And now the cors filters</p>
  
  <pre><code>    // add CORS filter
      $behaviors['corsFilter'] = [
          'class' =&gt; \yii\filters\Cors::className(),
            'cors' =&gt; [
          // restrict access to
          'Access-Control-Allow-Origin' =&gt; ['*'],
          'Access-Control-Request-Method' =&gt; ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],
          // Allow only POST and PUT methods
          'Access-Control-Request-Headers' =&gt; ['*'],
          // Allow only headers 'X-Wsse'
          'Access-Control-Allow-Credentials' =&gt; true,
          // Allow OPTIONS caching
          'Access-Control-Max-Age' =&gt; 86400,
          // Allow the X-Pagination-Current-Page header to be exposed to the browser.
          'Access-Control-Expose-Headers' =&gt; [],
        ]
      ];
  
      // re-add authentication filter
      $behaviors['authenticator'] = $auth;
         $behaviors['access'] = $access;
      // avoid authentication on CORS-pre-flight requests (HTTP OPTIONS method)
      $behaviors['authenticator']['except'] = ['options'];
      return $behaviors;
  }
  </code></pre>
  
  <p>An my angular2 frontend as </p>
  
  <pre><code>    const body = JSON.stringify(user);
  let headers = new Headers();
  headers.append('Content-Type', 'application/x-www-form-urlencoded');
  headers.append('Content-Type', 'application/json');
  headers.append('Access-Control-Allow-Credentials', "*");
  return this._http.post(this.loginUrl, body, { headers:headers })
    .map((response: Response) =&gt; {
       //process response
    })
  .catch(this.handleError);
  </code></pre>
  
  <p>But am still getting an error of</p>
  
  <pre><code>Response to preflight request doesn't pass access control check: No
   'Access-Control-Allow-Origin' header is present on the requested resource. Origin 
   'http://localhost:3000' is therefore not allowed access.
  </code></pre>
  
  <p>What could be wrong since ive set the cors filter in yii2 behaviours unset authenticator and added it later
  What could i be missing out</p>
  
  <p>I have also checked on <a href="https://stackoverflow.com/questions/39646736/cors-response-to-preflight-request-doesnt-pass-access-control-check-no-acces">This link</a> and also <a href="https://stackoverflow.com/questions/20035101/no-access-control-allow-origin-header-is-present-on-the-requested-resource">this one</a>
   but none solves the issue</p>