title: Still having "No 'Access Control Allow Origin' header is present on the requested resource" error after adding Access-Control-Allow-Origin: *
body: <p>I know this was tackled so many times before. But I can see on the response that there is Access-Control-Allow-Origin on the header already.</p>
  
  <p>This is my request code:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>var req = {
    method: 'POST',
    url: "integration-api.domain.com/login",
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'X-AN-WebService-IdentityKey': identitykey,
      'X-AN-WebService-CustomerAuthToken': customerAuth,
      'X-AN-WebService-CustomerTransientToken': transientToken,
      'Cache-Control': 'no-cache'
    },
    data: datatopass
  };
  
  console.log(datatopass);
  
  return $http(req).then(function(response){
    console.log(response);
    return response.data;
  }, function(err) {
    console.log(err);
    return err;
  });</code></pre>
  </div>
  </div>
  </p>
  
  <p><strong>This is the request header when viewing on chrome:</strong></p>
  
  <blockquote>
    <p><strong>Accept</strong>:<em>/</em><br>
    <strong>Accept-Encoding</strong>:gzip, deflate, sdch, br<br>
    <strong>Accept-Language</strong>:en-US,en;q=0.8<br>
    <strong>Access-Control-Request-Headers</strong>:x-an-webservice-identitykey<br>
    <strong>Access-Control-Request-Method</strong>:POST<br>
    <strong>Cache-Control</strong>:no-cache<br>
    <strong>Connection</strong>:keep-alive<br>
    <strong>Host</strong>:integration-api.domain.com<br>
    <strong>Origin</strong>:<a href="http://OriginDomain" rel="nofollow noreferrer">http://OriginDomain</a><br>
    <strong>Pragma</strong>:no-cache<br>
    <strong>Referer</strong>:<a href="http://OriginDomain/apitest/" rel="nofollow noreferrer">http://OriginDomain/apitest/</a><br>
    <strong>User-Agent</strong>:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36</p>
  </blockquote>
  
  <p><strong>Then the preflight response is:</strong></p>
  
  <blockquote>
    <p><strong>Access-Control-Allow-Headers</strong>:x-an-webservice-identitykey, origin, content-type, x-an-webservice-customerauthtoken, x-an-webservice-deviceauthtoken,x-an-webservice-customertransienttoken,x-an-webservice-version<br>
    <strong>Access-Control-Allow-Origin</strong>:*<br>
    Date:Wed, 30 Nov 2016 06:56:50 GMT</p>
  </blockquote>
  
  <p>Does the server needs to add Access-Control-Allow-Method or any other headers on the response or do I need to add something on my code?</p>
  
  <p>I'm using angular.js to call an $http call to the url</p>