CORS not working after enabling page speed on Apache

[fahadabid]

Hi

I have enabled page speed on Apache/2.4.25 (Debian)
Running on
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=debian

And added settings into the page speed are following
ModPagespeedAddResourceHeader "Access-Control-Allow-Origin" "*"
ModPagespeedAddResourceHeader "Access-Control-Allow-Credentials" "true"
ModPagespeedAddResourceHeader "Access-Control-Max-Age" "28800"
ModPagespeedAddResourceHeader "Access-Control-Allow-Methods" "POST, GET, OPTIONS, PUT, DELETE"
ModPagespeedAddResourceHeader "Access-Control-Allow-Headers" "Content-Type, X-Auth-Token, Origin, Authorization"

Still facing CROS issue

[Lofesa]

And what is your CROS issue?

[fahadabid]

I have two subdomains one is app.example.com and the other is api.example.com after enabling the page speed module the app can not any endpoint to API from the browser. If the disabled the module it works. The page speed module config is already shown above.

[Lofesa]

And these urls are rewrited by pagespeed?
Have you the content-security-policy header in place?
What error have you in the browser console?

[fahadabid]

And these urls are rewrited by pagespeed?
No, nothing like, I shared if I have to somethings to make it work.

Have you the content-security-policy header in place?
No

What error have you in the browser console?
Access to XMLHttpRequest at 'http://api.example.com/login' from origin 'http://app.example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[Lofesa]

Hi
I have found a issue #1794 seems is like yours.
These issue have no responses, so I don´t know if the user has solved this but you may ask to the user @tuananhzippy about it.
In this issue the headers set by ModPagespeedAddResourceHeader are not added.
See the issue #1760 and try changin the ModPagespeedAddResourceHeade directives with the apache config: Header setifempty Access-Control-Allow-Origin <MY_ORIGIN>