title: XSS Problems with Ajax GET Request
body: <p>I have the following coffee script which performs some sort of login:</p>
  
  <pre><code>signIn: (url, completion) -&gt;
    $.ajax
      method: 'GET'
      url: url
      dataType: 'json'
      error: (jqXHR, status, errorThrown) -&gt;
        completion false, errorThrown
      success: (data)-&gt;
        completion true, data.Identifier
  </code></pre>
  
  <p>When I check the given URL in the browser I get a valid JSON Response back.</p>
  
  <p>However, when this call is executed using JavaScript I get the following error in the console . Please note that I have changed the URLs for obfuscation: </p>
  
  <pre><code>XMLHttpRequest cannot load http://my.servicedomain.com/session/someIdentifier?access_token=secret. 
  Origin http://html.server.net is not allowed by Access-Control-Allow-Origin.
  </code></pre>
  
  <p>These are my headers, which I get from the <code>my.servicedomain.com</code> server:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-cache
  Pragma: no-cache
  Content-Length: 1417
  Content-Type: application/json; charset=utf-8
  Expires: -1
  Server: Microsoft-IIS/8.0
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Headers: Authorization
  Server: Microsoft-IIS/8.0
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ASP.NET
  X-Powered-By: ASP.NET
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Headers: Authorization
  Date: Wed, 10 Jul 2013 14:24:35 GMT
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: Keep-Alive
  </code></pre>
  
  <p>Why do I get this error, even though I have <code>Access-Control-Allow-Origin: *</code> in the response header?</p>