CORS Access-Control-Allow-Origin despite correct headers
Question: I am trying to set up simple Cross-Origin Resource Sharing using jQuery
(1.7.1) powered ajax on the client and apache served python (django) server.
According to all the instructions I have read my headers are set correctly,
but I keep getting the following error:

> XMLHttpRequest cannot load <http://myexternaldomain.com/get_data>. Origin
> <http://localhost:8080> is not allowed by Access-Control-Allow-Origin.

The header being I am trying to (I am not sure it is even getting past the
browser) send is:

    
    
    Request URL:http://myexternaldomain.com/get_data
    Accept:application/json, text/javascript, */*; q=0.01
    Origin:http://localhost:8080
    Referer:http://localhost:8080/static/js/test-zetta.html
    User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.66 Safari/535.11
    

The javascript code is

    
    
        var request = $.ajax({
            url : "http://myexternaldomain.com/get_data",
            type : "POST",
            dataType : "json",
            crossDomain : true
        });
    

Note that `origin` is set correctly. The server adds the header `Access-
Control-Allow-Origin = *` using the following python code

    
    
    def process_response(self, response):
        if response.has_header('Access-Control-Allow-Origin'):
                return response
    
        response['Access-Control-Allow-Origin'] = '*'
        return response
    
    def get_orders(request):
        """ Tell worker what to do """
        response_data = {}
        response_data['action'] = 'probe'
        response = process_response(HttpResponse(json.dumps(response_data), mimetype="application/json"))
        return response
    

If I visit the address directly, it appears to confirm that the header is
being set correctly

    
    
    Access-Control-Allow-Origin:*
    Content-Type:application/json
    Date:Thu, 08 Mar 2012 05:06:25 GMT
    Server:Apache/2.2.20 (Ubuntu)
    Transfer-Encoding:chunked
    

However in the cross domain setting it always fails (tried both chrome and
firefox). I've tried implementing the code exactly as per the selected answer
to [this](http://stackoverflow.com/questions/5251689/cross-domain-post-query-
using-cross-origin-resource-sharing-getting-no-data-back) question, but get
the same error

**Update**

I am quite sure that the problem is server side, as I have managed to get my
ajax calls working with a different public CORS enabled server. When I compare
the headers coming back from this public server, and the ones returned from
mine (when I test from same domain), I cannot see any major difference which
could account for difference (see below).

One subtlety that I excluded, which may or may be important is that the actual
domain is an amazon domain of multiple subdomains. The **real address** is
<http://ec2-23-20-27-108.compute-1.amazonaws.com/get_orders> , feel free to
probe it to see what I am doing wrong.

**From Public server**

    
    
    Access-Control-Allow-Origin:*
    Connection:Keep-Alive
    Content-Encoding:gzip
    Content-Length:622
    Content-Type:text/html
    Date:Thu, 08 Mar 2012 15:33:20 GMT
    Keep-Alive:timeout=15, max=99
    Server:Apache/2.2.14 (Ubuntu)
    Vary:Accept-Encoding
    X-Powered-By:Perl/5.8.7, PHP/4.4.0
    

**From my server - (not working cross domain)**

    
    
    Access-Control-Allow-Origin:*
    Content-Encoding:gzip
    Content-Type:text/plain
    Date:Thu, 08 Mar 2012 15:32:24 GMT
    Server:Apache/2.2.20 (Ubuntu)
    Transfer-Encoding:chunked
    Vary:Accept-Encoding
    


Answer: You have to implement a "pre-flighted" request and response because your
situation counts as a "[not so
simple](http://www.html5rocks.com/en/tutorials/cors/)" request. Basic CORS,
that only requires the Origin header, can only have content types of
"application/x-www-form-urlencoded", "multipart/form-data", and "text/plain".
Since you return "application/json", you don't meet this requirement.

I don't know anything about Django, but I found it easier to implement CORS
support outside of my application through the use of a [Tomcat
filter](https://bitbucket.org/jsumners/corsfilter). It looks like you can [do
the same thing](https://github.com/elevenbasetwo/django-cors) with Django.

**2013-08-11:** It looks like the GitHub repo is no longer with us. But the
Django package looks to still be available at
<https://pypi.python.org/pypi/django-cors/0.1>

