title: I have set access-control-allow-origin to *, but doesn't work?
body: <p>In my node.js server, I wrote:</p>
  
  <pre><code>res.writeHead(200, {'Content-Type': 'application/json;charset=utf-8', 'Access-Control-Allow-Origin':'*',"Access-Control-Allow-Headers": "X-Requested-With","Access-Control-Allow-Methods":"PUT,POST,GET,DELETE,OPTIONS"});
  </code></pre>
  
  <p>And through POSTMan in chrome, I can receive:</p>
  
  <pre><code>access-control-allow-headers → X-Requested-With
  access-control-allow-methods → PUT,POST,GET,DELETE,OPTIONS
  access-control-allow-origin → *
  </code></pre>
  
  <p>But if I try to access the url in my javascript, I still get warning:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://somedomain/login" rel="nofollow">http://somedomain/login</a>. Response to
    preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin 'null' is therefore not allowed access.</p>
  </blockquote>
  
  <p>I tested this on my localhost so the Origin is null. I've also tested on my server(another domain), not work.</p>
  
  <p>So how could I successfully send a cross domain request?</p>