title: Yii2 REST+ Angular Cross Domain CORS
body: <p>I have developed Angular &amp; Yii2  REST service. Have problem in cross domain.
  Here below add my angular &amp; Yii2 REST Code. </p>
  
  <p>AngularJs : (like '<a href="http://organization1.example.com" rel="noreferrer">http://organization1.example.com</a>','<a href="http://organization2.example.com" rel="noreferrer">http://organization2.example.com</a>',....)</p>
  
  <pre><code>$http.defaults.useXDomain = true;
  $http.defaults.withCredentials = true;
  $http.defaults.headers.common['Authorization'] = 'Bearer ' + MYTOKEN
  </code></pre>
  
  <p>My Request from Angular Controller:</p>
  
  <pre><code>apiURL = 'http://api.example.com';
  $http.get(apiURL + '/roles')
       .success(function (roles) { })
       .error(function () { });
  </code></pre>
  
  <p>Yii2 .htaccess: (REST URL like '<a href="http://api.example.com" rel="noreferrer">http://api.example.com</a>')</p>
  
  <pre><code>Header always set Access-Control-Allow-Origin: "*"
  Header always set Access-Control-Allow-Credentials: true
  Header always set Access-Control-Allow-Methods "POST, GET, PUT, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Authorization,X-Requested-With, content-type"
  </code></pre>
  
  <p>Yii2 My Behaviour:</p>
  
  <pre><code>public function behaviors() {
      $behaviors = parent::behaviors();
      $behaviors['corsFilter'] = [
          'class' =&gt; Cors::className(),
          'cors' =&gt; [
              'Origin' =&gt; ['*'],
              'Access-Control-Expose-Headers' =&gt; [
                  'X-Pagination-Per-Page',
                  'X-Pagination-Total-Count',
                  'X-Pagination-Current-Page',
                  'X-Pagination-Page-Count',
              ],
          ],
      ];
      $behaviors['authenticator'] = [
          'class' =&gt; HttpBearerAuth::className(),
          'except' =&gt; ['options'],
      ];
      $behaviors['contentNegotiator'] = [
          'class' =&gt; ContentNegotiator::className(),
          'formats' =&gt; [
              'application/json' =&gt; Response::FORMAT_JSON,
          ],
      ];
  
      return $behaviors;
  }
  </code></pre>
  
  <p><strong>Problem</strong></p>
  
  <p>From my angular request is 'GET' method, but it will goes 'OPTIONS' method &amp; return 401 Unauthorized error(CORS). because the request Authorization header is not send.</p>