title: Why do I get the ERROR: "No 'Access-Control-Allow-Origin' header present on the requested resource" although I specified the necessary header?
body: <p><strong>QUESTION:</strong></p>
  
  <p>I am getting an error whenever I make an AJAX request to my subdomain.</p>
  
  <p>The error tells me there is no 'Access-Control-Allow-Origin' header present on the requested resource.</p>
  
  <p>Yet, I seem to have specified an 'Access-Control-Allow-Origin' where needed ?</p>
  
  <p>What mistake have I made and how do I fix ti ? </p>
  
  <hr>
  
  <p><strong>ERROR:</strong></p>
  
  <p>Failed to load <code>https://subdomain.example.com/endpoint</code>: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<code>https://www.example.com</code>' is therefore not allowed access. The response had HTTP status code 500.</p>
  
  <hr>
  
  <p><strong>CODE:</strong></p>
  
  <p><strong>Client</strong></p>
  
  <pre><code>$.ajax({
          type: "POST",
          url: "https://subdomain.example.com/endpoint",
          data: theData,
          headers: {  
              'Access-Control-Allow-Origin': 'https://example.com',
              'Access-Control-Allow-Credentials': true
          },
          timeout: 600000,
          async: true,
          xhrFields: {withCredentials: true},
          crossDomain: true
      }).done(function(response) {
  </code></pre>
  
  <hr>
  
  <p><strong>Server</strong></p>
  
  <pre><code>var whitelist = ['https://example.com'];
  
  var corsOptions = {
      origin: function (origin, callback) {
          if (whitelist.indexOf(origin) !== -1) {
              callback(null, true)
          } else {
              callback(new Error('Not allowed by CORS'))
          }
      },
      credentials: true
  }
  
  router.options('/', cors(corsOptions), function(req,res,next){
      res.setHeader('Access-Control-Allow-Origin', 'https://example.com');
      res.status(200).end();
  });
  
  router.post("/", cors(corsOptions), function(req, res, next){
  
      res.setHeader('Access-Control-Allow-Origin', 'https://example.com');
      res.setHeader('Access-Control-Allow-Credentials', true);
  
   ...etc...
  </code></pre>