title: Keep getting No 'Access-Control-Allow-Origin' error with XMLHttpRequest
body: <p>I would have solved this issue by using jQuery <code>$.ajax</code> function but in this case jQuery is not option.  Instead I am going with CORS request.  I feel there is something wrong with the webserver that is responding to the request and I am having a hard time figuring out what the issue is.</p>
  
  <p>Here is my code for creating the CORS request</p>
  
  <pre><code>var httpRequest = new XMLHttpRequest();
  httpRequest.open('POST', url, true);
  httpRequest.setRequestHeader( 'Access-Control-Allow-Origin', '*');
  httpRequest.setRequestHeader( 'Content-Type', 'application/json' );
  httpRequest.onerror = function(XMLHttpRequest, textStatus, errorThrown) {
    console.log( 'The data failed to load :(' );
    console.log(JSON.stringify(XMLHttpRequest));
  };
  httpRequest.onload = function() {
    console.log('SUCCESS!');
  }
  </code></pre>
  
  <p>Here is the console.log error:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="http://test.testhost.com/testpage" rel="noreferrer">http://test.testhost.com/testpage</a>. Request header field
    Access-Control-Allow-Origin is not allowed by
    Access-Control-Allow-Headers.</p>
  </blockquote>
  
  <p>Here are the header information:</p>
  
  <pre><code>&gt; Remote Address:**.**.***.**:80 Request
  &gt; URL:http://test.testdomain.com/testpage Request
  &gt; Request Method:OPTIONS
  &gt; Status Code:200 OK
  </code></pre>
  
  <p><strong>Request Headers:</strong></p>
  
  <pre><code>OPTIONS /content-network HTTP/1.1
  Host: test.testhost.com
  Connection: keep-alive
  Cache-Control: no-cache
  Pragma: no-cache
  Access-Control-Request-Method: POST
  Origin: http://test.testdomain.com
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
  Access-Control-Request-Headers: access-control-allow-origin, content-type
  Accept: */*
  Referer: http://test.testdomain.com/
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  </code></pre>
  
  <p><strong>Response Headers:</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Thu, 14 Aug 2014 20:17:25 GMT
  Server: Apache
  Last-Modified: Thu, 14 Aug 2014 20:17:25 +0000
  Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
  ETag: "1408047445"
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Headers: Content-Type
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Access-Control-Allow-Headers: origin, x-requested-with, content-type
  Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS
  Content-Length: 6117
  Connection: close
  Content-Type: text/html; charset=utf-8
  </code></pre>