title: WSO2 APIM returns "Invalid CORS request" on PUT request
body: <p>"Invalid CORS request" is only observed on the PUT request when there is a origin header. It works fine on all other verbs, eg: GET. </p>
  
  <p>Have enabled using the wiki: <a href="https://docs.wso2.com/display/AM260/Enabling+CORS+for+APIs" rel="nofollow noreferrer">Enabling CORS for APIs</a> and also on the API level: /usr/lib64/wso2/wso2am/2.6.0/repository/deployment/server/synapse-configs/default/api/admin--Restricted_v1.0.0.xml</p>
  
  <p>PUT API: <code>
  curl -v 'https://api.mycompany.com/restricted/1.0.0/A/ba56bf80-9678-11e9-8508-0242ac110003' -XPUT -H 'Accept: application/json, text/plain, */*' -H 'Referer : http://local.mycompany.com:4200/B/' -H 'Origin : http://local.mycompany.com:4200' -H "Authorization : Bearer &lt;WSO2_ACCESS_TOKEN&gt;" -H "MYCOMPANY_AUTH : &lt;CUSTOM_AUTH_TOKEN&gt;" -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36' -H 'Content-Type: text/plain' --data-binary '{"ruleId":"ba56bf80-9678-11e9-8508-0242ac110003","created":"2019-06-24T15:43:53.289Z","context":"TM","version":3,"name":"e2e-testing-rule","author":"System Admin","description":"some description","expression":"a&gt;b","category":"ABC","score":"121","labels":["1","2","3"]}' --compressed</code></p>
  
  <p>RESPONSE: Invalid CORS request</p>
  
  <p>RESPONSE HEADERS: </p>
  
  <pre><code>* We are completely uploaded and fine
  &lt; HTTP/2 403 
  &lt; date: Thu, 27 Jun 2019 04:43:34 GMT
  &lt; content-type: application/octet-stream
  &lt; x-frame-options: DENY
  &lt; cache-control: no-cache, no-store, max-age=0, must-revalidate
  &lt; access-control-allow-origin: *
  &lt; access-control-allow-methods: PUT
  &lt; x-content-type-options: nosniff
  &lt; vary: Access-Control-Request-Headers
  &lt; vary: Access-Control-Request-Method
  &lt; vary: Origin
  &lt; expires: 0
  &lt; pragma: no-cache
  &lt; x-xss-protection: 1; mode=block
  &lt; access-control-allow-headers: authorization,Access-Control-Allow-Origin,Content-Type,SOAPAction,mycompany_auth,Accept-Encoding,Host,Content-Length,accept,referer,origin,user-agent,content-type
  
  </code></pre>
  
  <p>GET API:</p>
  
  <pre><code>curl -v -H "accept: */*" -H "Authorization : Bearer &lt;WSO2_ACCESS_TOKEN&gt;" -H "MYCOMPANY_AUTH : &lt;CUSTOM_AUTH_TOKEN&gt;" -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36' -H 'Content-Type: text/plain' https://api.mycompany.com/restricted/1.0.0/A/ba56bf80-9678-11e9-8508-0242ac110003 | jq .
  </code></pre>
  
  <p>RESPONSE: Valid JSON response</p>
  
  <p>RESPONSE HEADERS:</p>
  
  <pre><code>* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
  &lt; HTTP/2 200 
  &lt; date: Thu, 27 Jun 2019 04:38:50 GMT
  &lt; content-type: application/hal+json;charset=UTF-8
  &lt; x-frame-options: DENY
  &lt; cache-control: no-cache, no-store, max-age=0, must-revalidate
  &lt; access-control-allow-origin: *
  &lt; access-control-allow-methods: GET
  &lt; x-content-type-options: nosniff
  &lt; vary: Access-Control-Request-Headers
  &lt; vary: Access-Control-Request-Method
  &lt; vary: Origin
  &lt; expires: 0
  &lt; pragma: no-cache
  &lt; x-xss-protection: 1; mode=block
  &lt; access-control-allow-headers: authorization,Access-Control-Allow-Origin,Content-Type,SOAPAction,mycompany_auth,Accept-Encoding,Host,Content-Length,accept,referer,origin,user-agent,content-type
  </code></pre>
  
  <p>Since the GET calls works its not clear what was missed in the PUT call! Any pointers?</p>