title: Javascript CORS GET request blocked or invalid
body: <p>I'm struggling for quite some time already with issuing a simple GET request to a 3rd party REST Api. I've read a bit of tutorials and SO questions but I just can't get it to work. I am getting one of two errors</p>
  
  <p><strong>Response for preflight is invalid (redirect)</strong></p>
  
  <p>or (if via https)</p>
  
  <p><strong>Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://localhost:8433" rel="nofollow">https://localhost:8433</a>' is therefore not allowed access.</strong></p>
  
  <p>About 2nd message: Is it just a problem with the server not supporting CORS?</p>
  
  <p>My code:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>var xmlHttp = new XMLHttpRequest();
  var url = 'https://inspirehep.net/record/451647?of=recjson&amp;ot=recid,number_of_citations,authors,title'; //http or https, tried both
  
  /* 
     doing sth with response here like populate dropdown etc.
  */
  
  xmlHttp.open('GET', url, true);
  xmlHttp.setRequestHeader("Access-Control-Allow-Headers", "Content-Type, X-Requested-With, Cache-Control");
  xmlHttp.setRequestHeader("Content-Type", "application/json");
  xmlHttp.setRequestHeader("Access-Control-Allow-Origin", '*');
  xmlHttp.setRequestHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
  xmlHttp.setRequestHeader("Access-Control-Allow-Credentials", "true");
  xmlHttp.send();</code></pre>
  </div>
  </div>
  </p>
  
  <p>Whole app is running on node.js server (localhost) and the script above is included as separate file in .html view.</p>
  
  <p>I can correctly get json response from web-browser, fiddler, postman etc. for this API. I also tried different APIs (e.g. Openweather API) thinking that it's the problem with server configuration, but the result was the same.</p>
  
  <p>I would be thankful for any help - maybe i'm just misunderstanding something about CORS.</p>