JavaScript - XMLHttpRequest Access-Control-Allow-Origin errors

Question

I m attempting to send a XMLHttpRequest to a paste site  I m sending an object containing all the fields that the api requires  but I keep getting this issue  I have read over the issue  and I thought   httpReq setRequestHeader  Access-Control-Allow-Headers           Would fix it but it didn t  Does anyone have any information on this error and or how I can fix it   Here is my code    function            use strict        var httpReq   new XMLHttpRequest        var url    http   paste ee api       var fields    key public amp description test amp paste this is a test paste amp format JSON       var fields2    key   public   description   test   paste   this is a test paste   format   JSON         httpReq open  POST   url  true       console log  good         httpReq setRequestHeader  Access-Control-Allow-Headers             httpReq setRequestHeader  Content-type    application ecmascript        httpReq setRequestHeader  Access-Control-Allow-Origin             console log  ok         httpReq onreadystatechange   function              console log  test            if  httpReq readyState     4  amp  amp  httpReq status      success                 console log  test                alert httpReq responseText                         httpReq send fields2            And here is the exact console output   good ok Failed to load resource  No  Access-Control-Allow-Origin  header is present on the requested resource  Origin  http   127 0 0 1 40217  is therefore not allowed access  http   paste ee api XMLHttpRequest cannot load http   paste ee api  No  Access-Control-Allow-Origin  header is present on the requested resource  Origin  http   127 0 0 1 40217  is therefore not allowed access  index html 1 test   Here is the console output when I test it locally on a regular Chromium browser   good ok XMLHttpRequest cannot load http   paste ee api  No  Access-Control-Allow-Origin  header is present on the requested resource  Origin  null  is therefore not allowed access  index html 1 test

User · Answer

I ve gotten same problem   The servers logs showed   DEBUG   lt -- origin  null   I ve investigated that and it occurred that this is not populated when I ve been calling from file from local drive  When I ve copied file to the server and used it from server - the request worked perfectly fine

User · Answer

I think you ve missed the point of access control   A quick recap on why CORS exists  Since JS code from a website can execute XHR  that site could potentially send requests to other sites  masquerading as you and exploiting the trust those sites have in you e g  if you have logged in  a malicious site could attempt to extract information or execute actions you never wanted  - this is called a CSRF attack  To prevent that  web browsers have very stringent limitations on what XHR you can send - you are generally limited to just your domain  and so on   Now  sometimes it s useful for a site to allow other sites to contact it - sites that provide APIs or services  like the one you re trying to access  would be prime candidates  CORS was developed to allow site A e g  paste ee  to say  I trust site B  so you can send XHR from it to me   This is specified by site A sending  Access-Control-Allow-Origin  headers in its responses   In your specific case  it seems that paste ee doesn t bother to use CORS  Your best bet is to contact the site owner and find out why  if you want to use paste ee with a browser script  Alternatively  you could try using an extension those should have higher XHR privileges

[javascript] JavaScript - XMLHttpRequest, Access-Control-Allow-Origin errors

Examples related to javascript

Examples related to xmlhttprequest