Blocked by CORS policy

[Sa1ch]

Hello!
I use AXIOS on your frontend and pass the following headlines:

headers: { 'Authorization': 'Bearer {key}', 'Content-Type': 'application/json' }
In my bekend there is the following answer:

$di->set( 'response', function(){ $response = new Response(); $response ->setHeader("Access-Control-Allow-Origin", '*') ->setHeader("Access-Control-Allow-Methods", 'GET,POST,PUT') ->setHeader("Access-Control-Allow-Headers", '*') ->setHeader("Access-Control-Allow-Credentials", true) ->sendHeaders(); return $response; } );
An error comes in response: No 'Access-Control-Allow-Origin' header is present...
But if you remove the header Authorization, then the answer comes normally.

How to solve this problem?

[renatogabrielbr]

How is your server configured ?
Suppose it's a nginx you need to use header on you location / { }

You can use as get,post,put if all are the same remove the if.

if ($request_method = 'GET') {
  add_header 'Access-Control-Allow-Origin' '*';
 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, HEAD, PATCH';
 add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,Access-Control-Allow-Headers,Access-Control-Allow-Headers,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,X-Custom-Header';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
}

[Sa1ch]

Thanks for the answer!
I solved this problem.
It's all about the OPTIONS preliminary request that sends a browser.

specified a route for such a request:

$api->addOptions(
        '/:controller/:action/:params',
        [
            'controller' => 'index',
            'action'     => 'options',
            'params'     => 3
        ]
    );

indexController

public function optionsRequestAction()
    {
        $this->response
            ->setHeader('Access-Control-Allow-Origin', $_SERVER["HTTP_ORIGIN"])
            ->setHeader('Access-Control-Max-Age', '0')
            ->setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT')
            ->setHeader('Access-Control-Allow-Headers', '*')
            ->setHeader('Access-Control-Allow-Credentials', 'true')
            ->sendHeaders();
    }

And everything worked!
But I look for a more elegant solution. For example, through events...

[Jeckerson]

https://docs.phalcon.io/4.0/en/events#events-manager