Following This question i have set my rest controller behaviour as
public function behaviors()
{
$behaviors = parent::behaviors();
$auth= $behaviors
It is important to write $behaviors['access'] ie. AccessControl as a last parameter, for example:
public function behaviors() {
$behaviors = parent::behaviors();
// remove authentication filter
unset($behaviors['authenticator']);
$behaviors['corsFilter'] = [
'class' => \yii\filters\Cors::class,
'cors' => [
'Origin' => ['*'],
'Access-Control-Request-Method' => ['POST', 'GET', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],
'Access-Control-Allow-Headers' => ['Origin', 'X-Requested-With', 'Content-Type', 'accept', 'Authorization'],
'Access-Control-Request-Headers' => ['*'],
'Access-Control-Max-Age' => 3600, // Cache (seconds)
// Allow the X-Pagination-Current-Page header to be exposed to the browser.
'Access-Control-Expose-Headers' => ['X-Pagination-Total-Count', 'X-Pagination-Page-Count', 'X-Pagination-Current-Page', 'X-Pagination-Per-Page']
]
];
$behaviors['authenticator'] = [ ... whatever ... ];
$behaviors['access'] = [
'class' => AccessControl::className(),
'rules' => [
[
'allow' => true,
'actions' => ['options'], // important for cors ie. pre-flight requests
],
]
];
}