title: No 'Access-Control-Allow-Origin' header is present. But the header is present
body: <p>I have a problem with a jscropper. I don't know why I receive in console the message</p>
  
  <blockquote>
    <p>Failed to load <a href="https://cdn.dmove.it/images/409/foto1.jpg" rel="nofollow noreferrer">https://cdn.dmove.it/images/409/foto1.jpg</a>: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="https://www.dmove.it" rel="nofollow noreferrer">https://www.dmove.it</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>I try to read any answer and I understand that is a Cors problem, but by Cors configuration is ok.</p>
  
  <pre class="lang-none prettyprint-override"><code> curl -H "Origin: https://www.dmove.it" --verbose --head \
      https://cdn.dmove.it/images/412/ionity-cop.jpg &gt;&gt; debugcors.txt
  
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 13.32.176.105...
  * Connected to cdn.dmove.it (13.32.176.105) port 443 (#0)
  * found 148 certificates in /etc/ssl/certs/ca-certificates.crt
  * found 596 certificates in /etc/ssl/certs
  * ALPN, offering http/1.1
  * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
  *    server certificate verification OK
  *    server certificate status verification SKIPPED
  *    common name: cdn.dmove.it (matched)
  *    server certificate expiration date OK
  *    server certificate activation date OK
  *    certificate public key: RSA
  *    certificate version: #3
  *    subject: CN=cdn.dmove.it
  *    start date: Wed, 11 Oct 2017 00:00:00 GMT
  *    expire date: Sun, 11 Nov 2018 12:00:00 GMT
  *    issuer: C=US,O=Amazon,OU=Server CA 1B,CN=Amazon
  *    compression: NULL
  * ALPN, server accepted to use http/1.1
  &gt; HEAD /images/412/ionity-cop.jpg HTTP/1.1
  &gt; Host: cdn.dmove.it
  &gt; User-Agent: curl/7.47.0
  &gt; Accept: */*
  &gt; Origin: https://www.dmove.it
  &gt;
  &lt; HTTP/1.1 200 OK
  &lt; Content-Type: image/jpeg
  &lt; Content-Length: 113702
  &lt; Connection: keep-alive
  &lt; Date: Sat, 04 Nov 2017 10:03:51 GMT
  &lt; Access-Control-Allow-Origin: *
  &lt; Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD
  &lt; Access-Control-Max-Age: 3000
  &lt; Last-Modified: Fri, 03 Nov 2017 21:41:43 GMT
  &lt; ETag: "837db6c7a1ae9c54387629ff42fa3684"
  &lt; Cache-Control: max-age=315576000
  &lt; Accept-Ranges: bytes
  &lt; Server: AmazonS3
  &lt; Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
  &lt; Age: 620
  &lt; X-Cache: Hit from cloudfront
  &lt; Via: 1.1 4f95eb10423b781564e79d7c85f85795.cloudfront.net (CloudFront)
  &lt; X-Amz-Cf-Id: VDsmZGCzxLz5T9RCPlspCb2zyzjo7US-N5tsb605ojM3fv0jXxafxQ==
  &lt;
  </code></pre>
  
  <p>The website is <a href="https://www.dmove.it" rel="nofollow noreferrer">https://www.dmove.it</a>, the distribution is S3 with cloudfront and I whitelist the header in the distribution settings. </p>
  
  <p>What's wrong?</p>