# iEduPortal Stage 45: controlled CORS for the REST API.
# The API uses bearer tokens, not browser cookies, so credentials are not enabled.
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type, Accept, X-Requested-With"
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header always set Access-Control-Max-Age "600"
    Header always set Vary "Origin"
</IfModule>

# Let PHP endpoints handle OPTIONS when needed.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} =OPTIONS
    RewriteRule ^ - [L]
</IfModule>
