title: Using XMLHttpRequest without CORS by modifying HTTP headers?
body: <p>I'm doing some tests with the (deprecated) Twitter API 1.0</p>
  
  <p>For example, I want to get data from the API, client-side using AJAX browser requests from any cross-origin webpage. It can be a new blank tab, a local HTML page or any existing website.</p>
  
  <p>I've tried JSONP, it works great but I would like to use the default XMLHttpRequest even if Twitter servers do not support CORS <a href="http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing" rel="noreferrer">http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing</a>.</p>
  
  <p>On google.com homepage for example, I create a simple AJAX call to Twitter API that I execute with Firebug:</p>
  
  <pre><code>var xhr = new XMLHttpRequest();
  xhr.open("GET", "https://api.twitter.com/1/friends/ids.json?screen_name=baptx", false);
  xhr.send();
  </code></pre>
  
  <p>This will not work and print an error on Firebug due to the same origin policy:</p>
  
  <pre><code>Error: Failure
  xhr.send();
  </code></pre>
  
  <p>It returns an HTTP 200 OK code but no JSON data has been received from the server.</p>
  
  <p>I've seen two differences between a request from a google.com webpage and the api.twitter webpage (who works for Twitter API requests since it's the API domain name, same origin).</p>
  
  <p>An Origin HTTP header has been added with the current domain name:</p>
  
  <pre><code>Origin  https://www.google.com
  </code></pre>
  
  <p>The Referer HTTP header is not  <a href="https://api.twitter.com/" rel="noreferrer">https://api.twitter.com/</a> like a request from api.twitter.com page but is in my case:</p>
  
  <pre><code>Referer https://www.google.com/webhp?hl=en
  </code></pre>
  
  <p>That's why I've tried to remove the Origin HTTP header and modify the current Referer HTTP header to <a href="https://api.twitter.com/" rel="noreferrer">https://api.twitter.com/</a></p>
  
  <p>I've done this with the Firefox ModifyHeaders extension and it works, I can check in Firebug "Net" tab that those changes were made correctly.</p>
  
  <p>Now, I have the SAME request header from a request coming from google.com webpage and api.twitter.com webpage.
  It will still fail to do an AJAX request from another domain than the API, even if the HTTP headers are overwritten, why?</p>
  
  <p>By the way, do you know why an AJAX request to Twitter API from Firefox "New Tab" will work?</p>