ContentNegotiator::className(), 'formats' => [ 'application/json' => Response::FORMAT_JSON, 'application/xml' => Response::FORMAT_XML, ], ]; $behavior['corsFilter'] = [ 'class' => Cors::className(), 'cors' => [ 'Origin' => ['*'], 'Access-Control-Request-Method' => [ 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS' ], 'Access-Control-Request-Headers' => ['*'], ], ]; $behavior["authenticator"]["except"] = ['options']; return $behavior; } public function beforeAction($action) { if (!parent::beforeAction($action)) return false; \Yii::$app->getResponse()->format = Response::FORMAT_JSON; return true; } }