javascript - CORS 405 Method Not Allowed even though I have the right headers (I think) -

i need more eyes on this. preflight request failing 405 method not allowed.

as far can tell should working. here's request:

options http://diffdomain/spf/v1/user/user@example.com/password/change  http/1.1 host: diffdomain.com connection: keep-alive access-control-request-method: put origin: http://www.example.com user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, gecko) chrome/60.0.3112.113 safari/537.36 accept: */* referer: http://www.example.com/appname/index.html accept-encoding: gzip, deflate accept-language: en-us,es-us;q=0.8,es;q=0.6,en;q=0.4 

response:

http/1.1 405 method not allowed date: thu, 14 sep 2017 02:06:30 gmt server: apache/2.4.7 (ubuntu) access-control-allow-methods: post, get, put, options, delete x-powered-by: php/5.5.9-1ubuntu4.20 access-control-allow-origin: * access-control-allow-headers: content-type, api_key, authorization, accept content-length: 0 keep-alive: timeout=5, max=100 connection: keep-alive content-type: application/json 

i'm waiting access server can add access-control-request-method access-control-allow-headers line. help?

i need eyes, because i've been debugging few hours today , don't have access server yet.

when @sideshowbarker suggested below get:

> curl -i -x options http://diffdomain.com/spf/v1/user/user@example.com/password/change http/1.1 500 internal server error date: thu, 14 sep 2017 21:25:39 gmt server: apache/2.4.7 (ubuntu) access-control-allow-methods: post, get, put, options, delete x-powered-by: php/5.5.9-1ubuntu4.20 access-control-allow-origin: * access-control-allow-headers: content-type, api_key, authorization, accept, content-type, api_key, authorization, accept, access-control-request-method, origin content-length: 0 connection: close content-type: application/json