Question: I'm trying to make a simple cross-origin request, and Firefox is consistently blocking it with this error: 

> 
> Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [url]. This can be fixed by moving the resource to the same domain or enabling CORS. [url] 
> 
> 
> 

It works fine in Chrome and Safari. 

As far as I can tell I've set all the correct headers on my PHP to allow this to work. Here's what my server is responding with 

```
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 17:15:20 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u8
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Request-Headers: X-Requested-With, accept, content-type
Vary: Accept-Encoding
Content-Length: 186
Content-Type: text/html

```

I've tried using Angular, jQuery, and a basic XMLHTTPRequest object, like so:

```
var data = "id=1234"
var request = new XMLHttpRequest({mozSystem: true})
request.onload = onSuccess;
request.open('GET', 'https://myurl.com' + '?' + data, true)
request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')
request.send()

```

...and it works in every browser except Firefox. Can anyone help with this?

Answer: 
If you don't have a 'real' certificate (and thus using a self-signed one), in Firefox you can go to:

```
Options > Privacy & Security > (scroll to the bottom) View Certificates > Servers > Add Exception...

```

There, fill in the location, eg: `https://www.myserver:myport`
For posterity, also check server logs to see if the resource being requested is returning a 200.

I ran into a similar issue, where all of the proper headers were being returned in the pre-flight ajax request, but the browser reported the actual request was blocked due to bad CORS headers.

Turns out, the page being requested was returning a 500 error due to bad code, but only when it was fetched via CORS. The browser (both Chrome and Firefox) mistakenly reported that the Access-Control-Allow-Origin header was missing instead of saying the page returned a 500.