title: cesium header ‘Access-Control-Allow-Origin’ cannot be set
body: <p>I´m trying to access a WMS from statistik.at. Everything is working fine, when i use a browser extension that disables CORS errors, but as soon as I deactivate it i get the following error:</p>
  <blockquote>
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading
  the remote resource at
  <a href="https://www.statistik.at/gs-inspire/VIEW_PD_POPREG_500M/ows?SERVICE=WMS&amp;VERSION=1.3.0&amp;service=WMS&amp;version=1.1.1&amp;request=GetMap&amp;styles=&amp;format=image%2Fjpeg&amp;layers=PD.StatisticalDistribution&amp;bbox=90%2C0%2C180%2C90&amp;width=256&amp;height=256&amp;srs=EPSG%3A4326" rel="nofollow noreferrer">https://www.statistik.at/gs-inspire/VIEW_PD_POPREG_500M/ows?SERVICE=WMS&amp;VERSION=1.3.0&amp;service=WMS&amp;version=1.1.1&amp;request=GetMap&amp;styles=&amp;format=image%2Fjpeg&amp;layers=PD.StatisticalDistribution&amp;bbox=90%2C0%2C180%2C90&amp;width=256&amp;height=256&amp;srs=EPSG%3A4326</a>.
  (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).</p>
  </blockquote>
  <p>So, I´ve tried to set the missing header:</p>
  <pre class="lang-js prettyprint-override"><code>new WebMapServiceImageryProvider({
  url: new Resource({
    url:
      'https://www.statistik.at/gs-inspire/VIEW_PD_POPREG_500M/ows?SERVICE=WMS&amp;VERSION=1.3.0',
    headers: {
      ‘access-control-allow-origin’: 'www.statistik.at',
      },
    }),
    layers: ‘PD.StatisticalDistribution’,
  });
  </code></pre>
  <p>But the behaviour of setting access-control-allow-origin is rather unexpectable, because it set´s the following header:</p>
  <pre><code>Access-Control-Request-Headers: access-control-allow-origin
  </code></pre>
  <p>which makes every single request invalid…</p>
  <p>I hope that someone can help me out! looking forward for any ideas.</p>
  <p>Thank you</p>