title: CORS Header Missing on Angular Resource Requests Only
body: <p>I have a working node/express backend running on localhost. I'm building a project application that needs to fetch data from goodreads api. When I execute the request, I get: </p>
  
  <pre><code>Cross-Origin Request Blocked: 
  The Same Origin Policy disallows reading the remote resource at 
  https://www.goodreads.com/book/title.json?author=Arthur+Conan+Doyle&amp;key=[my_key]&amp;title=Hound+of+the+Baskervilles. 
  (Reason: CORS header 'Access-Control-Allow-Origin' missing).1 &lt;unknown&gt;
  </code></pre>
  
  <p>Server side, everything is working correctly. I have enabled CORS, and when I check the headers, 'Access-Control-Allow-Origin' is available on everything coming from my server after checking the header in Firefox and Chrome dev tools. When I make a request via $resource, however, 'Allow-Access...' is not present in my header. Here is the code for the resource:</p>
  
  <pre><code>.factory('goodReads', function($resource) {
      return $resource('https://www.goodreads.com/book/title.json');
  })
  .controller('AddBookSelectorController', function($resource, goodReads) {
      this.fetch = function() {
          var key = '[my_key]';
          var data = goodReads.query({author: 'Arthur Conan Doyle', key: key, title: 'Hound of the Baskervilles'});
          console.log(data);
      };
  });
  </code></pre>
  
  <p>I'm calling fetch via ng-click, and everything executes fine except I get the CORS error. Can anyone point me in the right direction? I am new to angular, and my suspicion is there is a problem with my resource request or something in configuration, but I can't seem to find an answer to fix my problem in the documentation or other stackoverflow questions. </p>
  
  <p><strong>Update 3:</strong> It is not a localhost issue. I tried pushing it to my domain and using a simple button which ran an xhr request to the OpenBooks api, and the problem got worse. It is hosted via Openshift, and now the 'Allow-Control-Access-x' headers are gone even for other files on my server. Really beginning to bang my head against the wall here. I am removing the Angular tags, because it has nothing to do with Angular.</p>
  
  <p><strong>UPDATE 2:</strong> I got it working after installing 'Allow-Control-Allow-Origin' extension in Chrome. Has my problem been the fact that I'm running this on localhost? Or is there something else going on? The header is still not being set without the extension.</p>
  
  <p><strong>UPDATE:</strong> I've been working on this since 8am, and still no luck. I have tried rewriting the request using Angular's $http and also with Javascript's xhr following the example from <a href="http://www.html5rocks.com/en/tutorials/cors/" rel="nofollow">HTML5 Rocks | Using Cors</a> and I'm still having the same problem with each method. Like I said, the necessary header information is available from files on my server, but it breaks when I make requests to other sites. </p>
  
  <p>I'm starting to think this might not be an Angular problem, but I really have no clue. Just to be safe, here is the code I added to Express to enable CORS, including app.use so you can get an idea for where I called it: </p>
  
  <pre><code>app.use(logger('dev'));
  app.use(bodyParser.json());
  app.use(bodyParser.urlencoded({ extended: false }));
  app.use(cookieParser());
  app.use(function(req, res, next) {
      res.header("Access-Control-Allow-Origin", "*");
      res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Length");
      res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
      res.header("Access-Control-Allow-Credentials", "true");
      next();
  });
  app.use(express.static(path.join(__dirname, 'public')));
  
  app.use('/', routes);
  </code></pre>
  
  <p><strong>Edit: Here are the headers from the API request:</strong></p>
  
  <p>Request Headers</p>
  
  <pre><code>Host: www.goodreads.com
  User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101     Firefox/40.0
  Accept: application/json, text/plain, */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  DNT: 1
  Referer: http://localhost:3000/
  Origin: http://localhost:3000
  Connection: keep-alive
  </code></pre>
  
  <p>Response Headers</p>
  
  <pre><code>Cache-Control: max-age=0, private, must-revalidate
  Content-Encoding: gzip
  Content-Length: 686
  Content-Type: application/json; charset=utf-8
  Date: Wed, 02 Sep 2015 17:20:35 GMT
  Etag: "a2be782f32638d2a435bbeaf4b01274a-gzip"
  Server: Server
  Set-Cookie: csid=BAhJIhg1MzgtNTk4NjMzNy0wNzQ4MTM5BjoGRVQ%3D--afed14b563e5a6eb7b3fa9005de3010474230702; path=/; expires=Sun, 02 Sep 2035 17:20:33 -0000
  locale=en; path=/
  _session_id2=fd45336b8ef86010d46c7d73adb5f004; path=/; expires=Wed, 02 Sep 2015 23:20:35 -0000; HttpOnly
  Status: 200 OK
  Vary: Accept-Encoding,User-Agent
  X-Content-Type-Options: nosniff, nosniff
  X-Frame-Options: ALLOWALL
  X-Request-Id: 1K8EJWG30GWDE4MZ4R5K
  X-Runtime: 2.277972
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p><strong>Headers for the .js file from my server:</strong></p>
  
  <p>Request</p>
  
  <pre><code>Host: localhost:3000
  User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101   Firefox/40.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  DNT: 1
  Referer: http://localhost:3000/
  Cookie: _ga=GA1.1.1924088292.1439681064; connect.sid=s%3AB4O0Up9WF5iqkfky__I0XCiBD2aMATlq.gbJUC9GseqnJvRTEIbcwxD6cwFQeL7ljNScURCJ5As0
  Connection: keep-alive
  If-Modified-Since: Wed, 02 Sep 2015 17:08:40 GMT
  If-None-Match: W/"886-14f8f0828c1"
  Cache-Control: max-age=0
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>Accept-Ranges: bytes
  Access-Control-Allow-Origin: *
  Cache-Control: public, max-age=0
  Connection: keep-alive
  Date: Wed, 02 Sep 2015 17:20:30 GMT
  Etag: W/"886-14f8f0828c1"
  Last-Modified: Wed, 02 Sep 2015 17:08:40 GMT
  X-Powered-By: Express
  access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
  </code></pre>