OIDCInfoHook with CORS not working

[zandbelt]

I'm accessing the OIDCInfoHook via mydomain.com/redirect?info=json&access_token_refresh_interval=0 from my SPA.
If the SPA have the same domain as Apache then everything works. But when I run my SPA from a different domain (mydomain:8095) then I get CORS issues.

I tried to set headers in Apache with mod_headers but mod_auth_openidc removes them all when I access the OIDCInfoHook via mydomain.com/redirect?info=json&access_token_refresh_interval=0

(https://github.com/zmartzone/mod_auth_openidc/wiki/Single-Page-Applications#session-info-authorization)

Is it expected behaviour or bug? Any ideas how to solve the Cors issues?