title: CORS, IIS7 and PHP - Access-Control-Allow-Origin error
body: <p>i'm trying to allow another host (a local host, like <code>javascript.dev</code>) to make a xhr to this host, it is an IIS7 and if i <code>curl -I</code> it, this is the headers:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Content-Length: 0
  Content-Type: text/html; charset=UTF-8
  Server: Microsoft-IIS/7.0
  X-Powered-By: PHP/5.3.28
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
  Access-Control-Max-Age: 1000
  Access-Control-Allow-Headers: *
  X-Powered-By: ASP.NET
  Date: Fri, 20 Jun 2014 12:09:33 GMT
  </code></pre>
  
  <p>this is the headers for <code>curl -v -X OPTIONS</code>:</p>
  
  <pre><code>* About to connect() to www2.xxxxxxxxxxxx.com.br port 80 (#0)
  *   Trying 200.98.xxx.100...
  * Connected to www2.xxxxxxxxxxxx.com.br (200.98.xxx.100) port 80 (#0)
  &gt; OPTIONS /jobs/xxxxxxx/user/ HTTP/1.1
  &gt; User-Agent: curl/7.30.0
  &gt; Host: www2.xxxxxxxxxxxx.com.br
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 200 OK
  &lt; Allow: OPTIONS, TRACE, GET, HEAD, POST
  * Server Microsoft-IIS/7.0 is not blacklisted
  &lt; Server: Microsoft-IIS/7.0
  &lt; Public: OPTIONS, TRACE, GET, HEAD, POST
  &lt; X-Powered-By: ASP.NET
  &lt; Date: Fri, 20 Jun 2014 13:01:25 GMT
  &lt; Content-Length: 0
  </code></pre>
  
  <p>i used php to change the <code>Access-Control-Allow-Origin</code>, but when i do the xhr, with or without jquery, this is the error i'm getting:</p>
  
  <pre><code>XMLHttpRequest cannot load http://www2.xxxxxxxx.com.br/jobs/xxxxxx/user/. 
  No 'Access-Control-Allow-Origin' header is present on the requested resource. 
  Origin 'http://javascript.dev' is therefore not allowed access. 
  </code></pre>
  
  <p>to document, additional steps i made to solve:</p>
  
  <p>i added code in the answer above to my web.config and get this error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://www2.madeinweb.com.br/jobs/eminhasaude/user. 
  Request header field Content-Type is not allowed by Access-Control-Allow-Headers. 
  </code></pre>
  
  <p>because <code>Access-Control-Allow-Headers</code> don't accept wildcards <code>*</code>. to solve:</p>
  
  <pre><code>&lt;add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" /&gt;
  </code></pre>