It seems the * wildcard is not supported on a local server (or disallowed by chrome)Sorry, when I changed the origin to
$response = $response->withHeader('Access-Control-Allow-Origin', 'http://localhost:4200');
instead of
$response = $response->withHeader('Access-Control-Allow-Origin', '*');my bad. The solution is simple:
The "Cache-control" header in the request seems to be not allowed, although it worked fine when testing the api with Postman. I removed the header from the request and everything worked well.