title: Cross-Origin Request Blocked
body: <p>So I've got this Go http handler that stores some POST content into the datastore and retrieves some other info in response. On the back-end I use:</p>
  
  <pre><code>func handleMessageQueue(w http.ResponseWriter, r *http.Request) {
      w.Header().Set("Access-Control-Allow-Origin", "*")
      if r.Method == "POST" {
  
          c := appengine.NewContext(r)
  
          body, _ := ioutil.ReadAll(r.Body)
  
          auth := string(body[:])
          r.Body.Close()
          q := datastore.NewQuery("Message").Order("-Date")
  
          var msg []Message
          key, err := q.GetAll(c, &amp;msg)
  
          if err != nil {
              c.Errorf("fetching msg: %v", err)
              return
          }
  
          w.Header().Set("Content-Type", "application/json")
          jsonMsg, err := json.Marshal(msg)
          msgstr := string(jsonMsg)
          fmt.Fprint(w, msgstr)
          return
      }
  }
  </code></pre>
  
  <p>In my firefox OS app I use:</p>
  
  <pre><code>var message = "content";
  
  request = new XMLHttpRequest();
  request.open('POST', 'http://localhost:8080/msgs', true);
  
  request.onload = function () {
      if (request.status &gt;= 200 &amp;&amp; request.status &lt; 400) {
          // Success!
          data = JSON.parse(request.responseText);
          console.log(data);
      } else {
          // We reached our target server, but it returned an error
          console.log("server error");
      }
  };
  
  request.onerror = function () {
      // There was a connection error of some sort
      console.log("connection error");
  };
  
  request.send(message);
  </code></pre>
  
  <p>The incoming part all works along and such. However, my response is getting blocked. Giving me the following message:</p>
  
  <pre><code>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8080/msgs. This can be fixed by moving the resource to the same domain or enabling CORS.
  </code></pre>
  
  <p>I tried a lot of other things but there is no way I can just get a response from the server. However when I change my Go POST method into GET and access the page through the browser I get the data that I want so bad. I can't really decide which side goes wrong and why: it might be that Go shouldn't block these kinds of requests, but it also might be that my javascript is illegal.</p>