title: Setting CURL headers using CURLOPT_HTTPHEADER creates CORS problem
body: <p>I am trying to do a cURL POST request defining HTTP Headers with PHP and I am getting CORS problem.</p>
  
  <p>So I have a .php file that is called from a webapp using AJAX. In this .php file I am doing a HTTP POST request to an external API using cURL. It all worked fine until I had to set different HTTP Headers for authentication purposes. When I try to define the HTTP Headers in the cURL request using:</p>
  
  <pre><code>//Set Headers
  curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Authorization': 'someAuthorization',
    'x-api-key': 'somekey',
    'Content-Type': 'application/x-www-form-urlencoded'
  ));
  </code></pre>
  
  <p>I start getting a CORS problem between the client (webapp) and my own endpoint which wasnt happening before. I tried to define the headers again after executing the cURL request but it didnt work:</p>
  
  <pre><code>//execute post
  $result = curl_exec($ch);
  if($result === false){
    echo 'Curl error: ' . curl_error($ch);
  }else{
  //$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  //CORS
  if (isset($_SERVER['HTTP_ORIGIN'])) {
      //header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
      header("Access-Control-Allow-Origin: http://localhost:4200");
      header('Access-Control-Allow-Credentials: true');    
      header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); 
  }   
  if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
      if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
          header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         
      if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
          header("Access-Control-Allow-Headers: 
  {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");
      exit(0);
  }
  echo $result;
  };
  </code></pre>
  
  <p>Any ideas why this is happening? To me it seems that by performing the cURL request I am overriding the headers with cURL so the CORS header configuration is never applied.</p>
  
  <p>Heres all the code in the .php file</p>
  
  <pre><code>&lt;?php
  
  $url = 'someurl';
  $fields = ['pax' =&gt; '2', 'ownerid' =&gt; '1', 'channel' =&gt; '3'];
  
  //url-ify the data for the POST
  $fields_string = http_build_query($fields);
  
  //open connection
  $ch = curl_init();
  
  //set the url, number of POST vars, POST data
  curl_setopt($ch,CURLOPT_URL, $url);
  curl_setopt($ch,CURLOPT_POST, count($fields));
  curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string);
  
  //So that curl_exec returns the contents of the cURL; rather than echoing it
  curl_setopt($ch,CURLOPT_RETURNTRANSFER, true); 
  
  //Set Headers
  curl_setopt($ch, CURLOPT_HTTPHEADER, array(
  'Authorization': 'someAuth',
  'x-api-key': 'someKey',
  'Content-Type': 'application/x-www-form-urlencoded',
  ));
  
  //DISABLE SSL
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  
  //execute post
  $result = curl_exec($ch);
  if($result === false){
    echo 'Curl error: ' . curl_error($ch);
  }else{
    //$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    //CORS
    if (isset($_SERVER['HTTP_ORIGIN'])) {
      //header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
      header("Access-Control-Allow-Origin: http://localhost:4200");
      header('Access-Control-Allow-Credentials: true');    
      header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); 
    }   
    if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
      if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
          header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         
      if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
          header("Access-Control-Allow-Headers:{$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");
      exit(0);
    }
    echo $result;
  };
  
  curl_close($ch);
  ?&gt;
  </code></pre>