# Preflight CORS SlimFramework

**URL:** <https://discourse.slimframework.com/t/preflight-cors-slimframework/2012>\
**Category:** Questions\
**Created:** [November 14, 2017, 4:41am UTC](https://discourse.slimframework.com/t/preflight-cors-slimframework/2012 "2017-11-14T04:41:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![virtualslim](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@virtualslim](https://discourse.slimframework.com/u/virtualslim)\
**Post date:** [November 14, 2017, 4:41am UTC](https://discourse.slimframework.com/t/preflight-cors-slimframework/2012/1 "2017-11-14T04:41:14Z")

</div>

I need help on handling preflighted CORS request with SlimFramework. I’m sending a post request with a ‘token’ header using [Angular HTTP](https://angular.io/api/http/Http). This is what I have in the server to manage the CORS stuff:

```
$app->options('/{routes:.+}', function ($request, $response, $args) {
    return $response;
});

$app->add(function ($req, $res, $next) {
    $response = $next($req, $res);
    return $response
            ->withHeader('Access-Control-Allow-Origin', '*')
            ->withHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization, token')
            ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
});

```

But I get in the Chrome browser:

VM7078:1 OPTIONS net::ERR\_SPDY\_PROTOCOL\_ERROR

I don’t know how the code in the server is supposed to be to avoid this issue. Everything works with Postman.