如果服务器http状态不是200，则启用CORS

Question

I enabled CORS on server side using:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "GET, POST, OPTIONS"

I send a post message using angular $http.post() to server and everything is working good. But if the server is sending 403 header, preflight fails.

header("HTTP/1.1 403 Not allowed");

Whatever I send the same result occurs. Even if I send http status 200.

Cross-Origin Request Blocked: 
The Same Origin Policy disallows reading the remote resource at http://api.server.com/. 
(Reason: CORS preflight channel did not succeed).

Answer 1

For pre-flight to succeed, an OPTIONS call to the URL must return 200 along with the CORS headers.

The follow up POST (or whatever) can return other status codes, but the OPTIONS request must succeed.

Answer 2

Header always add Access-Control-Allow-Origin "*"
Header always add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header always add Access-Control-Allow-Methods "GET, POST, OPTIONS"

Pay attention to the always .

For more information, see Apache doc