title: Why do some cross domain XMLHttpRequest requests NOT return CORS error
body: <p>For some API's the data is easily accessible and does not throw the following CORS error.</p>
  
  <p>XMLHttpRequest cannot load <a href="http://external.service/" rel="nofollow noreferrer">http://external.service/</a>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://my.app" rel="nofollow noreferrer">http://my.app</a>' is therefore not allowed access.</p>
  
  <p>I am confused as to why it does NOT throw an error. </p>
  
  <p>In Node.js when I wanted to enable CORS on my server I had to do this:</p>
  
  <pre><code>res.header("Access-Control-Allow-Origin", "*");
  
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
  </code></pre>
  
  <p>I assume the following API's have been setup in a similar way,  but I am looking for validation that this is true. I want my understanding to be technically accurate.</p>
  
  <p>If there is another explanation, I would like to know it. </p>
  
  <p>Some examples of API's that don't throw CORS errors are:</p>
  
  <p><a href="https://itunes.apple.com/hk/rss/topalbums/limit=10/json" rel="nofollow noreferrer">https://itunes.apple.com/hk/rss/topalbums/limit=10/json</a></p>
  
  <p><a href="http://www.omdbapi.com/?s=Star%20Wars&amp;r=json" rel="nofollow noreferrer">http://www.omdbapi.com/?s=Star%20Wars&amp;r=json</a></p>
  
  <p><a href="https://api.github.com/users/" rel="nofollow noreferrer">https://api.github.com/users/</a><strong>name-of-user</strong></p>