I could use another set of eyes on this. My preflight request is returning a 405 Method Not Allowed error.
After reviewing, everything seems to be in order. Here's the request:
OPTIONS http://diffDomain/spf/v1/user/<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5b2e283e291b3e233a362b3736">[email protected]</a>/password/change
HTTP/1.1
Host: diffDomain.com
Connection: keep-alive
Access-Control-Request-Method: PUT
Origin: http://www.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Accept: */*
Referer: http://www.example.com/appName/index.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,es-US;q=0.8,es;q=0.6,en;q=0.4
Response:
HTTP/1.1 405 Method Not Allowed
Date: Thu, 14 Sep 2017 02:06:30 GMT
Server: Apache/2.4.7 (Ubuntu)
Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, DELETE
X-Powered-By: PHP/5.5.9-1ubuntu4.20
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type, api_key, Authorization, Accept
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json
I'm waiting for server access so I can add Access-Control-Request-Method to the Access-Control-Allow-Headers line. Would that make a difference?
I just need some fresh perspective as I've been troubleshooting this issue all day and still don't have the necessary server access.
Following @sideshowbarker's suggestion below, I tried:
> curl -i -X OPTIONS http://diffDomain.com/spf/v1/user/<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5e2b2d3b2c1e3b263f332e32323b703d3133">[email protected]</a>/password/change
HTTP/1.1 500 Internal Server Error
Date: Thu, 14 Sep 2017 21:25:39 GMT
Server: Apache/2.4.7 (Ubuntu)
Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, DELETE
X-Powered-By: PHP/5.5.9-1ubuntu4.20
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type, api_key, Authorization, Accept, Content-Type, api_key, Authorization, Accept, Access-Control-Request-Method, Origin
Content-Length: 0
Connection: close
Content-Type: application/json