title: How/where to enable CORS(cross origin resource sharing)?
body: <p>I am not able to access cross domain resources from my <em>javascript</em> file using <em>XMLHttpRequest()</em>. 
  I understand that there are a few similar questions, I went through some of them but I have a bit of confusion regarding some of the details. 
  I will mention my exact Setup and my specific doubts. </p>
  
  <p>Setup:</p>
  
  <p>I have my HTML and JS files on an apache server running on a ubuntu machine present in my local LAN network . The application is bascially hls plugin for video.js.
  From my windows PC in the same local LAN, I open the index.html file for the hls player. As long as I select video content which is present on the linux machine, it works fine as expected, but on giving it an external content( E.g. <a href="http://devimages.apple.com/iphone/samples/bipbop/bipbopall.m3u8" rel="nofollow">http://devimages.apple.com/iphone/samples/bipbop/bipbopall.m3u8</a>), it fails and gives the error:</p>
  
  <p><em>XMLHttpRequest cannot load <a href="http://devimages.apple.com/iphone/samples/bipbop/bipbopall.m3u8" rel="nofollow">http://devimages.apple.com/iphone/samples/bipbop/bipbopall.m3u8</a>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://172.20.33.49" rel="nofollow">http://172.20.33.49</a>' is therefore not allowed access.</em></p>
  
  <p>(Here 172.20.33.49 is the IP of the linux machine)</p>
  
  <p>So my queries are:</p>
  
  <ol>
  <li><p>On which server should the <em>Access-Control-Allow-Origin</em> header be set to appropriate value(lets say '*' for simplicity) for this to work: on my local linux server or the server hosting the external content or both?</p></li>
  <li><p>Is there any setting/configuration/code change which I need to do in my browser/javascript or HTML code for this to work?</p></li>
  <li>As a general query, is there anything the client can/should do for CORS to work or is it purely a server requirement/configuration?</li>
  <li>Is the '<em>Access-Control-Allow-Origin</em>' mandatory in HTTP responses? If not then what does its absence mean - Does it mean only resources from same domain can be accessed or does it mean all domains are accessible(equivalent to *) ? Is there any way a client can force a server to add this header?</li>
  </ol>