php - Slim framework does not send http headers when http status is not 200

Solution:

I guess you get this internal warning in PHP:

Warning: Undefined array key "HTTP_ORIGIN"

This warning will be sent by PHP before the Slim $response is getting handled.

Please note that the HTTP_ORIGIN header is not always present, and it is not good practice to rely on this key. Instead it's better to check the domain and send a * when it's valid.

This prevent this warning try this:

$httpOrigin = $request->getServerParams()['HTTP_ORIGIN'] ?? '';
if($httpOrigin) {
    $response = $response->withHeader('Access-Control-Allow-Origin', $httpOrigin);
}

return  $response->withHeader('Content-Type', 'text/plain')
    ->withHeader('X-Error-Message', $message)
    ->withStatus(403);

Answer

Solution:

The issue as reported in not caused by the slim framework. Our hosting provider is using apache as web server. Apache is causing this behaviour.

See https://bz.apache.org/bugzilla/show_bug.cgi?id=61820 for more details.

Source