Why isn't my cross-domain request working?

1
votes

http://pastebin.com/B9MqcM1D

Failed to load resource: Request header field Access-Control-Allow-Origin is not allowed by Access-Control-Allow-Headers.

--disable-web-security Doesn't help.

1
google-chromecross-domain

1 Answers

0
votes

Access-Control-Allow-Origin is a response header not a request header.

It has to be sent by the server you are making the request to.

CORS would be useless if the site hosting the JavaScript could grant itself permission to access any site on the WWW.