title: Why does my JavaScript code receive a "No 'Access-Control-Allow-Origin' header is present on the requested resource" error, while Postman does not?
body: <blockquote>
  <p><strong>Mod note</strong>: This question is about why <code>XMLHttpRequest</code>/<code>fetch</code>/etc. on the browser are subject to the Same Access Policy restrictions (you get errors mentioning CORB or CORS) while Postman is not. This question is <strong>not</strong> about how to fix a &quot;No 'Access-Control-Allow-Origin'...&quot; error. It's about why they happen.</p>
  </blockquote>
  <blockquote>
  <p><strong>Please stop posting</strong>:</p>
  <ul>
  <li>CORS configurations for every language/framework under the sun. Instead <a href="https://stackoverflow.com/search?q=how+to+enable+CORS+is%3Aquestion&amp;mixed=1">find your relevant language/framework's question</a>.</li>
  <li>3rd party services that allow a request to circumvent CORS</li>
  <li>Command line options for turning off CORS for various browsers</li>
  </ul>
  </blockquote>
  <hr />
  <p>I am trying to do authorization using <a href="http://en.wikipedia.org/wiki/JavaScript" rel="noreferrer">JavaScript</a> by connecting to the <a href="http://en.wikipedia.org/wiki/Representational_state_transfer#RESTful_web_services" rel="noreferrer">RESTful</a> <a href="http://en.wikipedia.org/wiki/Application_programming_interface" rel="noreferrer">API</a> built-in <a href="https://en.wikipedia.org/wiki/Flask_%28web_framework%29" rel="noreferrer">Flask</a>. However, when I make the request, I get the following error:</p>
  <pre class="lang-js prettyprint-override"><code>XMLHttpRequest cannot load http://myApiUrl/login. 
  No 'Access-Control-Allow-Origin' header is present on the requested resource. 
  Origin 'null' is therefore not allowed access.
  </code></pre>
  <p>I know that the API or remote resource must set the header, but why did it work when I made the request via the Chrome extension <a href="https://chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop" rel="noreferrer">Postman</a>?</p>
  <p>This is the request code:</p>
  <pre class="lang-js prettyprint-override"><code>$.ajax({
        type: 'POST',
        dataType: 'text',
        url: api,
        username: 'user',
        password: 'pass',
        crossDomain: true,
        xhrFields: {
          withCredentials: true,
        },
      })
        .done(function (data) {
          console.log('done');
        })
        .fail(function (xhr, textStatus, errorThrown) {
          alert(xhr.responseText);
          alert(textStatus);
        });
  </code></pre>