title: How to get around CORS error on a 307 redirect
body: <p>I'm using a 307 redirect <code>mod_rewrite</code> rule in my <code>.htaccess</code> to redirect all <code>/api/...</code> requests to an <code>apiHandler.php</code>, and I'm having trouble with CORS.</p>
  
  <p>My <code>.htaccess</code></p>
  
  <pre><code>RewriteEngine On
  RewriteRule ^api/(.*)$ /apiHandler.php [NC,R=307]
  </code></pre>
  
  <p>My <code>apiHandler.php</code></p>
  
  <pre><code>&lt;?php
  
  header("Access-Control-Allow-Origin: http://localhost:4200");
  header("Access-Control-Allow-Credentials: true");
  header("Access-Control-Allow-Headers: Content-Type");
  header("Content-Type: application/json");
  
  ...
  
  ?&gt;
  </code></pre>
  
  <p>Whenever I make an api request in my front-end, I get a CORS error,</p>
  
  <pre><code>"...has been blocked by CORS policy: No 'Access-Control-Allow-Origin` header is present on the request resource."
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/70NwK.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/70NwK.jpg" alt="cors issue"></a></p>
  
  <p>yet I specifically have that header in my <code>apiHandler.php</code>, so I don't know what the issue is.</p>
  
  <p>After doing a little bit of research, I've heard that the redirecting URL must also include an <code>Access-Control-Allow-Origin</code> header, or else the browser will stop right there with its attempted cross-domain request. But I've already tried also adding those headers to my <code>.htaccess</code> with no luck.</p>
  
  <p>Any ideas?</p>