title: IE 11, XMLHttpRequest, and CORS
body: <p>I'm trying to access an API service (via XMLHttpRequest/ajax) hosted on a sub-domain (ie: a client on app.samedomain.com will call out to api.samedomain.com) that requires specific headers to be set for security purposes, but I keep getting <code>Access is denied</code> errors. All the solutions I've found say the client/end user must add the site to the "Trusted Sites" security zone, but obviously this is not a real solution. What do I need to do to access an external site with specific headers?</p>
  
  <p>Example Code:</p>
  
  <pre><code>var getUserById = function (user, callback, error) {
    $.support.cors = true; 
    var endpoint = _getApiVersion() + '/person/model/' + user.userId;
    var _headers = _setHeaders(endpoint, null, user, 'GET');
    $.ajax({
      type: 'GET',
      beforeSend: function (request)
      {
        request.setRequestHeader("api-key", _headers['api-key']);
        request.setRequestHeader("timestamp", _headers['timestamp']);
        request.setRequestHeader("content-md5", _headers['content-md5']);
        request.setRequestHeader("content-type", _headers['content-type']);
        request.setRequestHeader("signature", _headers['signature']);
        request.setRequestHeader("Access-Control-Allow-Origin", "*");
      },
      url: _getBaseUrl() + endpoint,
      data: null,
      contentType: 'application/json',
      dataType: 'json',
      success: callback,
      error: error
    });
  };
  </code></pre>
  
  <p>Thanks in advance,<br>
  Dan</p>