title: Allow headers in cross-domain ajax request
body: <p>The first Ajax request receives a response, but not the second which includes a header.  How can I allow headers to be included in a cross-domain Ajax request.</p>
  
  <p>Note - I expect I need to make a server-side change, and <a href="https://stackoverflow.com/a/32140436/1032531">https://stackoverflow.com/a/32140436/1032531</a> also says so, but doesn't say how to make those changes.  Also, I am not looking for a jQuery only solution.</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8"&gt;
          &lt;title&gt;Testing&lt;/title&gt;  
          &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.js" type="text/javascript"&gt;&lt;/script&gt;
          &lt;script type="text/javascript"&gt; 
              $(function(){
                  $.ajax({
                      type:'POST',
                      url:'http://otherdomain.example.com/ajax.php',
                  })
                  $.ajax({
                      type:'POST',
                      url:'http://otherdomain.example.com/ajax.php',
                      headers: {"X-Test-Header": "test-value"},
                  })
              });
          &lt;/script&gt;
      &lt;/head&gt;
  
      &lt;body&gt;&lt;/body&gt; 
  &lt;/html&gt; 
  </code></pre>
  
  <p>FF response to the second Ajax request:</p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading
    the remote resource at <a href="http://otherdomain.example.com/ajax.php" rel="nofollow noreferrer">http://otherdomain.example.com/ajax.php</a>.
    (Reason: missing token 'x-test-header' in CORS header
    'Access-Control-Allow-Headers' from CORS preflight channel).</p>
  </blockquote>
  
  <p>Chrome responds to the second as:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://otherdomain.example.com/ajax.php" rel="nofollow noreferrer">http://otherdomain.example.com/ajax.php</a>.
    Request header field X-Test-Header is not allowed by
    Access-Control-Allow-Headers in preflight response. Apache is set up
    as</p>
  </blockquote>
  
  <p>follows:</p>
  
  <pre><code>Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
  Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization, Client-Security-Token, Accept-Encoding"
  </code></pre>