title: Workaround for IoT device without CORS headers
body: <p>I have an <a href="https://www.arylic.com/" rel="nofollow noreferrer">IoT device</a> with an <a href="https://developer.arylic.com/httpapi/#http-api" rel="nofollow noreferrer">HTTP API</a> - I am building a very simple HTML + JS interface with no server component.</p>
  <p>Using a simple XMLHttpRequest I am able to make calls to the API however I am hitting an issue with CORS; all calls to the API respond with a 200, and take the proper action on the IoT device; the calls return the proper values according to the network inspection tab however no data is returned to the callback.</p>
  <p>Given two functions:</p>
  <pre><code>// Helper API Request Method
  function call(host, cmd, callback) {
          var xhr = new XMLHttpRequest();
          xhr.onload = function(data) { console.log(data); };
          xhr.open(&quot;GET&quot;, &quot;http://&quot; + host + &quot;/httpapi.asp?command=&quot; + cmd);
          xhr.send();
  }
  
  // Set output volume level (0-&gt;100)
  function a_vol(master, vol) {
          call(master, &quot;setPlayerCmd:vol:&quot; + vol);
  }
  </code></pre>
  <p>When I call the function in the JS console, I don't have access to the returned object:</p>
  <pre><code>a_vol(&quot;10.3.106.120&quot;, 80);
  undefined
  Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://10.3.106.120/httpapi.asp?command=setPlayerCmd:mute:0. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.
  </code></pre>
  <p>Observed in Network tab:</p>
  <blockquote>
  <p>Response body is not available to scripts (Reason: CORS Missing Allow Origin)</p>
  </blockquote>
  <p>Given that I can not edit the firmware of the device to include the CORS headers, and that the device still responds as expected to the API commands, what can I do to avoid this error message and access the returned object, if even an override for this domain.</p>