title: CakePHP 3 REST API + CORS Request and OPTIONS method
body: <p>I am working on a REST API using CakePHP 3. I want to enable it publicly, so anyone can mane a call to API.
  So, I have added cors headers as defined here: <a href="http://book.cakephp.org/3.0/en/controllers/request-response.html#setting-cross-origin-request-headers-cors" rel="noreferrer">http://book.cakephp.org/3.0/en/controllers/request-response.html#setting-cross-origin-request-headers-cors</a></p>
  
  <p>I have implemented the EventListener on Dispatcher.beforeDispatch and Dispatcher.beforeDispatch to prepare the cors headers.</p>
  
  <pre><code>class ApiResponseHeaders implements EventListenerInterface
  {
  
      /**
       * Event bindings
       *
       * @return array
       */
      public function implementedEvents()
      {
          return [
              'Dispatcher.beforeDispatch' =&gt; [
                  'callable' =&gt; 'beforeDispatch',
                  'priority' =&gt; 0
              ],
              'Dispatcher.afterDispatch' =&gt; [
                  'callable' =&gt; 'afterDispatch',
                  'priority' =&gt; 99999
              ]
          ];
      }
  
      public function beforeDispatch(Event $event)
      {
          $request = $event-&gt;data['request'];
          if ('OPTIONS' === $request-&gt;method()) {
              $event-&gt;stopPropagation();
          }
      }
  
      public function afterDispatch(Event $event)
      {
          $request = $event-&gt;data['request'];
          $response = $event-&gt;data['response'];
  
          $response-&gt;cors($request)
                  -&gt;allowOrigin('*')
                  -&gt;allowMethods(['GET', 'POST', 'OPTIONS'])
                  -&gt;allowHeaders(['Content-Type, Authorization, X-Requested-With, Accept'])
                  -&gt;allowCredentials()
                  -&gt;maxAge(0)
                  -&gt;build();
  
          if ('OPTIONS' === $request-&gt;method()) {
              $event-&gt;stopPropagation();
          }
      }
  
  }
  </code></pre>
  
  <p>But the problem is, when I make an POST request to API endpoint from AngularJS, first it makes OPTIONS method call and then POST method. CakePHP does not process the OPTIONS method call and returns: 400 Bad Request</p>
  
  <p>Below are the sample request and response headers:</p>
  
  <p>Request headers</p>
  
  <pre><code>OPTIONS /v1/account/login HTTP/1.1
  Host: api.cake.dev
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Access-Control-Request-Method: POST
  Access-Control-Request-Headers: content-type
  Origin: http://demo.angular.dev
  Connection: keep-alive
  </code></pre>
  
  <p>Response headers</p>
  
  <pre><code>HTTP/1.1 400 Bad Request
  Date: Wed, 07 Sep 2016 08:34:55 GMT
  Server: Apache/2.4.17 (Win64) PHP/5.6.16
  X-Powered-By: PHP/5.6.16
  X-DEBUGKIT-ID: b4e5654a-cefb-43b7-bf19-4e8c7ffdb0e0
  access-control-allow-origin: *
  access-control-allow-methods: GET, POST, OPTIONS
  access-control-allow-headers: Content-Type, Authorization, X-Requested-With, Accept
  Access-Control-Allow-Credentials: true
  access-control-max-age: 0
  Content-Length: 147
  Connection: close
  Content-Type: text/html; charset=UTF-8
  </code></pre>
  
  <p>Is there a way available in CakePHP 3 to handle this OPTIONS request and return correct response so than the next POST request work correctly?</p>
  
  <p>Please help.
  Thank you</p>