Yii2 RestApi CORS reject when upload data - .htaccess

Question

I make a RestAPI,
when post or get data it working correctly.
For example post a comment, post a status or get data.
But everytime I upload (picture) using fineuploader, It's always reject by server and return 404 error with message. but it's working fine when using postman. Here's the error message:
Firefox:
(Reason: CORS preflight channel did not succeed).
Chrome:
Response for preflight has invalid HTTP status code 404
This is my behavior with cors enabled in controller
public function behaviors()
{
$behaviors = parent::behaviors();
// replace to top contentNegotiator filter for displaying errors in correct format
$content_negotiator = $behaviors['contentNegotiator'];
unset($behaviors['contentNegotiator']);
$content_negotiator['formats'] = Yii::$app->params['formats'];
$behaviors = ArrayHelper::merge(
[
'contentNegotiator' => $content_negotiator,
'oauth2access' => [ // should be before "authenticator" filter
'class' => OAuth2AccessFilter::className()
],
'exceptionFilter' => [
'class' => ErrorToExceptionFilter::className()
],
'corsFilter' => [
'class' => \yii\filters\Cors::className(),
'cors' => [
'Origin' => ['*'],
'Access-Control-Allow-Headers' => 'X-Requested-With,Content-Type',
'Access-Control-Request-Method' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],
'Access-Control-Request-Headers' => ['*'],
'Access-Control-Allow-Credentials' => true,
],
],
],
$behaviors,
[
'access' => [
'class' => AccessControl::className(),
'rules' => $this->accessRules(),
'ruleConfig' => ['class' => 'api\components\AccessRule'],
],
]
);
return $behaviors;
}
and my .htaccess set like this
<IfModule mod_rewrite.c>
<IfModule mod_headers.c>
# Define the root domain that is allowed
SetEnvIf Origin .+ ACCESS_CONTROL_ROOT=mydomain.com
SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
# Check that the Origin: matches the defined root domain and capture it in
# an environment var if it does
RewriteEngine On
RewriteCond %{ENV:ACCESS_CONTROL_ROOT} !=""
RewriteCond %{ENV:ACCESS_CONTROL_ORIGIN} =""
RewriteCond %{ENV:ACCESS_CONTROL_ROOT}&%{HTTP:Origin} ^([^&]+)&(https?://(?:.+?\.)?\1(?::\d{1,5})?)$
RewriteRule .* - [E=ACCESS_CONTROL_ORIGIN:%2]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# Otherwise forward it to index.php
RewriteRule ^(.*)$ /index.php/$1 [L]
# Set the response header to the captured value if there was a match
Header set Access-Control-Allow-Origin %{ACCESS_CONTROL_ORIGIN}e env=ACCESS_CONTROL_ORIGIN
Header set Access-Control-Allow-Credentials "true"
</IfModule>
</IfModule>
and my fineuploader is like this
function createEventUploader() {
var uploader = new qq.FineUploader({
debug: false,
multiple: false,
element: document.getElementById('eventuploader'),
request: {
endpoint: apiUrl + '/uploads/event?access_token='+access_token,
method: 'POST'
},
resume: {
enabled: true
},
retry: {
enableAuto: false,
maxAutoAttempts: 1,
showButton: true,
},
validation: {
allowedExtensions: ['jpeg', 'jpg', 'png'],
// sizeLimit: 800000,// 200 kB = 200 * 1024 bytes
},
cors:{
allowXdr: true,
expected: true,
sendCredentials: true,
},
callbacks: {
onUpload: function(id, name) {},
onComplete: function(id, name, responseJSON) {
var data = JSON.stringify(responseJSON);
data = JSON.parse(data);
if (data.success) {
$('#eventcover').val(data.uploadName);
}
},
onError: function(id, name, errorReason, xhrOrXdr) {
bootbox.alert(qq.format("Error on file number {} - {}. Reason: {}", id, name, errorReason));
}
}
});
}
The problem happen only on upload.
Please somebody help me with this problem.