Mr Jedi Mr Jedi - 3 months ago 24
Javascript Question

"No 'Access-Control-Allow-Origin' header is present on the requested resource"

I am trying to do authorization using JavaScript by connecting to the RESTful API built in Flask.

As result I get:

XMLHttpRequest cannot load http://myApiUrl/login. No
'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'null' is therefore not allowed access.

I know that the API or remote resource must set the header, but why did it work when I tested authorization in the Chrome extension POSTMAN?

This is the request code:

type: "POST",
dataType: 'text',
url: api,
username: 'user',
password: 'pass',
crossDomain : true,
xhrFields: {
withCredentials: true
.done(function( data ) {
.fail( function(xhr, textStatus, errorThrown) {


If I understood it right you are doing an XMLHttpRequest to a different domain than your page is on. So the browser is blocking it as it usually allows a request in the same origin for security reasons. You need to do something different when you want to do a cross-domain request. A tutorial about how to achieve that is Using CORS.

When you are using postman they are not restricted by this policy. Quoted from Cross-Origin XMLHttpRequest:

Regular web pages can use the XMLHttpRequest object to send and receive data from remote servers, but they're limited by the same origin policy. Extensions aren't so limited. An extension can talk to remote servers outside of its origin, as long as it first requests cross-origin permissions.