title: Symfony 2 - Allow OPTIONS requests
body: <p>I have a symfony 2 backend and I have installed it on a server. My frontend is an ionic PWA, so it runs in browser and it is also installed on that server, but with an other subdomain. When I send a request from the web app to the backend, I'm getting this error:</p>
  
  <blockquote>
    <p>OPTIONS <a href="https://api.example.com/api/login.json" rel="nofollow noreferrer">https://api.example.com/api/login.json</a></p>
    
    <p>XMLHttpRequest cannot load <a href="https://api.example.com/api/login.json" rel="nofollow noreferrer">https://api.example.com/api/login.json</a>. Response
    for preflight has invalid HTTP status code 405</p>
  </blockquote>
  
  <p>This is my code for the login action:</p>
  
  <pre><code>/**
   * Login via username and password or via API key
   *
   * @Doc\ApiDoc(
   *  section="Security",
   *  description="Login",
   *  views={"default", "security"}
   * )
   *
   * @param ParamFetcher $params
   *
   * @Rest\RequestParam(name="username", nullable=true, description="Username")
   * @Rest\RequestParam(name="password", nullable=true, description="Password")
   * @Rest\RequestParam(name="apikey", nullable=true, description="API key (alternative to username + password)")
   *
   * @Rest\Post("/login", name="api_security_login", options={"method_prefix" = false})
   *
   * @return Response
   */
  public function loginAction(ParamFetcher $params)
  {
      //...do some stuff here...//
  
      $data = array(
          'user'   =&gt; $userValue,
          'apikey' =&gt; $user-&gt;getApiKey(),
      );
  
      $groups = array('default', 'private');
  
      return $this-&gt;createAPIResponse(self::STATUS_OK, $data, $groups);
  }
  </code></pre>
  
  <p>This is header from the response:</p>
  
  <pre><code>Access-Control-Allow-Methods:GET,POST,OPTIONS,DELETE,PUT
  Access-Control-Allow-Origin:*
  Allow:POST
  Cache-Control:no-cache
  Connection:Keep-Alive
  Content-Length:54
  Content-Type:application/json
  Date:Tue, 29 Aug 2017 08:33:26 GMT
  Keep-Alive:timeout=5, max=100
  Server:Apache
  </code></pre>
  
  <p>This is the error message in the prod.log file:</p>
  
  <blockquote>
    <p>request.ERROR: Uncaught PHP Exception
    Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException:
    "No route found for "OPTIONS /api/login.json": Method Not Allowed
    (Allow: POST)" at
    /var/www/example.com/api/htdocs/symfony/vendor/symfony/symfony/src/Symfony/Component/HttpKernel/EventListener/RouterListener.php
    line 163 {"exception":"[object]
    (Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException(code:
    0): No route found for \"OPTIONS /api/login.json\": Method Not Allowed
    (Allow: POST) at
    /var/www/example.com/api/htdocs/symfony/vendor/symfony/symfony/src/Symfony/Component/HttpKernel/EventListener/RouterListener.php:163,
    Symfony\Component\Routing\Exception\MethodNotAllowedException(code:
    0):  at
    /var/www/example.com/api/htdocs/symfony/app/cache/prod/appProdUrlMatcher.php:855)"}
    []</p>
  </blockquote>
  
  <p>So it seems like the OPTIONS request, which is send because CORS, is not allowed, because of the "Allow" header, where only "POST" is allowed. So what is the best way to fix that for all routes?</p>