If Code does not exit here: (e.q. internal CORS Control not used) https://github.com/jacwright/RestServer/blob/119eee48bd76520c83c4a26f7b3dbce0adcc24d5/source/Jacwright/RestServer/RestServer.php#L123 It will crash here: https://github.com/jacwright/RestServer/blob/119eee48bd76520c83c4a26f7b3dbce0adcc24d5/source/Jacwright/RestServer/RestServer.php#L131 Because of "Access-Control-Request-Headers" which is not a valid variable name.