title: CORS problem with XMLHttpRequest from localhost to REST service with FireFox
body: <p>Now when I am opening a development page on my localhost using IIS server and trying to make a <code>XMLHttpRequest</code> to a REST service on another server usin FireFox, I got this error: </p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading
    the remote resource at
    <a href="https://carto48dev.education.gouv.qc.ca/arcgis/rest/services/DEV/AUTH_SERVICES/GPServer/Login/execute" rel="nofollow noreferrer">https://carto48dev.education.gouv.qc.ca/arcgis/rest/services/DEV/AUTH_SERVICES/GPServer/Login/execute</a>.
    (Reason: CORS header ‘Access-Control-Allow-Origin’ does not match
    ‘<a href="https://localhost:8080" rel="nofollow noreferrer">https://localhost:8080</a>’).</p>
  </blockquote>
  
  <p>This problem seems to be new in FireFox (version 62.0.2) as it was working before and I dont have this problem using Chrome or IE.</p>
  
  <p><strong>I would like to understand why it was working before and not now, and why it's still working in Chrome but not in FireFox</strong> </p>
  
  <p><strong>Is it most likely that something was changed on the REST service or something in FireFox security?</strong></p>
  
  <p>Here is the response headers from the REST service:</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: http://localhost:8080
  Cache-Control: max-age=0,must-revalidate, max-age=60
  Connection: Keep-Alive
  Content-Encoding: gzip
  Content-Type: text/plain;charset=utf-8
  Date: Tue, 02 Oct 2018 12:30:29 GMT
  Expires: Tue, 02 Oct 2018 12:41:30 GMT
  Keep-Alive: timeout=15, max=100
  Set-Cookie: UqZBpD3n3iPIDwJU9Am+pGqSSQ@@=v…Sep-2028 12:30:28 GMT; Path=/
  Transfer-Encoding: chunked
  Vary: Origin
  Vary: Accept-encoding
  </code></pre>
  
  <p>Here is how I make the <code>XMLHttpRequest</code>:</p>
  
  <pre><code>function makeRequest(url, postData, options)
      return new Promise(function(resolve, reject) {
          var xhr = new XMLHttpRequest();
          url = options.method == "GET" ? url + "?" + _encodePostData(postData) : url;
          xhr.open(options.method, url, options.async);
          xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
          xhr.onreadystatechange = function() {
              if (xhr.readyState == 4 &amp;&amp; xhr.status == 200) {
                  var response = JSON.parse(xhr.response);
                  //service internal error
                  if (response.results[1].value) {
                      reject(response.results[1].value);
                  } else {
                      resolve(response.results[0].value);
                  }
              }
          };
      });
  };
  </code></pre>