title: Express JS: No 'Access-Control-Allow-Origin' header is present on the requested resource
body: <p>I have an API running on a server and a front-end client connecting to it to retrieve data. I did some research on the cross domain problem and has it working. However I've not sure what has changed. I am now getting this error in the console:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="https://api.mydomain/api/status" rel="noreferrer">https://api.mydomain/api/status</a>. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://beta.mydomain.com" rel="noreferrer">http://beta.mydomain.com</a>' is therefore not allowed
    access. The response had HTTP status code 502.</p>
  </blockquote>
  
  <p>I have the following route file:</p>
  
  <pre><code>var express = require('express');
  var router = express.Router();
  var Assessment = require('../app/models/assessment');
  
  router.all('*', function (req, res, next) {
      res.header('Access-Control-Allow-Origin', '*');
      res.header('Access-Control-Allow-Methods', 'PUT, GET, POST, DELETE, OPTIONS');
      res.header('Access-Control-Allow-Headers', 'Content-Type');
      next();
  });
  
  
  router.post('/api/status', function (req, res, next) {
      getStatus.getStatus(req, res, Assessment);
  });
  
  module.exports = router;
  </code></pre>
  
  <p>And the following JavaScript making an Ajax call to that route:</p>
  
  <pre><code>var user = {
      'uid' : '12345'
  };
  $.ajax({
      data: user,
      method: 'POST',
      url: 'https://api.mydomain/api/status',
      crossDomain: true,
      done: function () {
      },
      success: function (data) {
          console.log(JSON.stringify(data));
      },
      error: function (xhr, status) {
  
      }
  });
  </code></pre>
  
  <p>I have tried: 
  Putting the requesting domain in the 'Access-Control-Allow-Origin' header
  Using the cors module for express
  Putting my router.all function inside middleware</p>
  
  <p>The requesting domain is HTTP and the api domain is on HTTPS. However, I have had it working while the HTTP was enabled. </p>
  
  <p>Does anyone have any insight into why the 'Access-Control-Allow-Origin' header is not being send?</p>
  
  <p>Thank you</p>