title: Getting Spotify API access token from frontend JavaScript code
body: <p>I have a web app that allows people to generate a list of songs by artists that are related to a particular artist. I want to be able to connect to the user's Spotify account and create a playlist for them from that list of songs, but I need to get an access token. I have a developer account and client ID and am trying to work through the Authorization Flow, but it's not working for me. Instead, I get this error: <code>XMLHttpRequest cannot load https://accounts.spotify.com/authorize/?client_id=d137fe25b31c4f3ba9e29d85f…:3000/callback&amp;scope=user-read-private%20user-read-email&amp;state=34fFs29kd09. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.</code></p>
  
  <p>This is a portion of my <code>scripts.js</code> file (i'm using the <code>spotify-web-api-js</code> node module):</p>
  
  <pre><code>$('#spotify').on('click', function() {
      $.support.cors = true;
      $.getJSON("https://accounts.spotify.com/authorize/?client_id=d137fe25b31c4f3ba9e29d85f4e47c66&amp;response_type=code&amp;redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&amp;scope=user-read-private%20user-read-email&amp;state=34fFs29kd09", function(json2){
      $.getJSON("https://accounts.spotify.com/api/token/?grant_type=authorization_code&amp;code=" + json2.code + "&amp;redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&amp;client_id=d137fe25b31c4f3ba9e29d85f4e47c66&amp;client_secret={...}", function(json3) {
        s.setAccessToken(json3.access_token);
        });
      });
    });
  });
  </code></pre>
  
  <p>According to my research, it's a CORS-related issue. I'm making edits to my ExpressJS server to remedy this cross-origin problem and installed the <code>cors</code> node module, but I'm still getting the same error. </p>
  
  <p><code>index.js</code> server:</p>
  
  <pre><code>var express = require('express');
  var cors = require('cors');
  var app = express();
  var port = 3000;
  
  app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
  });
  
  
   app.use(express.static(__dirname + '/public')); // looks in public directory, not root directory (protects files)
  
   app.get('/', function(req, res) {
       res.send(__dirname + '\\index.html')
  });
  
  app.listen(port, function() {
            console.log('CORS-enabled web server listening on port ' + port);
  });
  </code></pre>
  
  <p>When I go to the URL in question directly through my browser, it gives me the expected "Do you authorize this app to use your Spotify information" form.</p>
  
  <p>Should I require 'cors' in 'scripts.js' for it to work? Does anyone have any other suggestions?</p>