title: Is it possible to use XMLHttpRequest across Domains
body: <p>Cross Site XMLHttpRequest from JavaScript can it be done?</p>
  
  <p>I understand the limitations and why it is not generally able to work, but as of firefox 3.5 there is the </p>
  
  <p><code>Access-Control-Allow-Origin: *</code></p>
  
  <p>which is supposed to allow this to work.</p>
  
  <p>It tells the browser that the server does not care if the request is sent to it from a domain that did not serve the page.</p>
  
  <p>The code I am using is below. <br/></p>
  
  <pre><code>function sendData(webservicePayload, callbackFunction) {
  var request = null;
  if (!window.XMLHttpRequest) { // code for IE
      try {
          request = new ActiveXObject('Msxml2.XMLHTTP');
      } catch (e) {
          try {
              request = new ActiveXObject('Microsoft.XMLHTTP');
          } catch (E) {
              return 'Create XMLHTTP request IE';
          }
      }
  } else { // code for Mozilla, etc.
      request = new XMLHttpRequest();
  }
  /*
   * Setup the callback function
   */
  request.onreadystatechange = function() {
      if (request.readyState == 4 &amp;&amp; request.status &lt; 300) {
          eval(callbackFunction);
      }
  };
  if (!request) {
      nlapiLogExecution('ERROR', 'Create XMLHTTP request', 'Failed');
      return;
  }
  /*
   * Setup the request headers
   */
  
  request.open('POST','http://www.another.domain.co.uk/webservice.asmx', true);
  request.setRequestHeader('Man','POST http://www.another.domain.co.uk/webservice.asmx HTTP/1.1');
  request.setRequestHeader('MessageType', 'CALL');
  request.setRequestHeader('Content-Type', 'text/xml; charset="utf-8"');
  request.setRequestHeader('Cache-Control', 'no-cache');
  request.setRequestHeader("X-Requested-With", "XMLHttpRequest");
  request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
  
  request.setRequestHeader('SOAPAction','http://www.another.domain.co.uk/WebService/eService');
  request.send(webservicePayload);
  </code></pre>
  
  <p>}</p>
  
  <p>This is sending the correct request header</p>
  
  <p>REQUEST<br/></p>
  
  <pre><code>OPTIONS /webservice.asmx HTTP/1.1
  Host: www.another.domain.co.uk
  User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-gb,en;q=0.5
  Accept-Encoding: gzip, deflate
  Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
  Connection: keep-alive
  Origin: https://my.domain.com
  Access-Control-Request-Method: POST
  Access-Control-Request-Headers: cache-control,content-type,man,messagetype,soapaction
  Pragma: no-cache
  Cache-Control: no-cache
  </code></pre>
  
  <p>and receiving an expected response header</p>
  
  <p>RESPONSE<br/></p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Server: Microsoft-IIS/5.1
  Date: Wed, 14 Dec 2011 13:43:27 GMT
  X-Powered-By: ASP.NET
  Access-Control-Allow-Origin: *
  Connection: close
  Content-Type: text/html
  Content-Length: 44
  </code></pre>
  
  <p>As you can see the Orgin is specified in the request and the server responds with acceptance of any ("*") domain.</p>
  
  <p>Why am I getting "Forbidden 403" as I feel that everything I have done is correct, I can't work out why?</p>
  
  <p>Is anyone else getting this?</p>
  
  <p>Do you know what is causing it?</p>