Fixes #9137: Added `Access-Control-Allow-Method` header for the OPTIONS request

framework/CHANGELOG.md

@@ -11,6 +11,7 @@ Yii Framework 2 Change Log
 - Bug #15194: Fixed `yii\db\QueryBuilder::insert()` to preserve passed params when building a `INSERT INTO ... SELECT` query for MSSQL, PostgreSQL and SQLite (sergeymakinen)
 - Bug #15229: Fixed `yii\console\widgets\Table` default value for `getScreenWidth()`, when `Console::getScreenSize()` can't determine screen size (webleaf)
 - Bug #15234: Fixed `\yii\widgets\LinkPager` removed `tag` from `disabledListItemSubTagOptions` (SDKiller)
+- Enh #9137: Added `Access-Control-Allow-Method` header for the OPTIONS request (developeruz)
 - Enh #15135: Automatic completion for help in bash and zsh (Valkeru)
 - Enh #14662: Added support for custom `Content-Type` specification to `yii\web\JsonResponseFormatter` (Kolyunya)
 - Enh #14568: Refactored migration templates to use `safeUp()` and `safeDown()` methods (Kolyunya)

framework/rest/OptionsAction.php

@@ -40,5 +40,6 @@ class OptionsAction extends \yii\base\Action
         }
         $options = $id === null ? $this->collectionOptions : $this->resourceOptions;
         Yii::$app->getResponse()->getHeaders()->set('Allow', implode(', ', $options));
+        Yii::$app->getResponse()->getHeaders()->set('Access-Control-Allow-Method', implode(', ', $options));
     }
 }