Origin not allowed by Access-Control-Allow-Origin Perl - perl

Question

I am making a request to remote perl server. but got the problem as
XMLHttpRequest cannot load http://otherdomain.com/getPub.pl?content=hello. Origin http://localhost is not allowed by Access-Control-Allow-Origin.
I already enable access_control_allow_origin to be "*" in perl script, codes as following:
#!/usr/bin/perl
use strict;
use CGI qw(:standard);
use warnings;
my $cgi = new CGI;
print $cgi -> header(
-type => 'text/plain',
-access_control_allow_origin => '*',
);
my $content = $cgi -> param('content');
open(CON,">content.txt") || die "can't open $!";
print CON $content;
close(CON);
and the js request as followings:
function sendData(){
var url = "http://otherdomain.com/getPub.pl?content=hello";
var xhr = createCORSRequest("GET", url);
if(!xhr){
throw new Error ('CORS not supported');
}
xhr.send();
}
function createCORSRequest(method, url){
var xhr = new XMLHttpRequest();
if("withCredentials" in xhr){
xhr.open(method,url,true);
}else if(typeof XDomainRequest != "undefined"){
xhr = new XDomainRequest();
xhr.open(method, url);
}else{
xhr = null;
}
return xhr;
}
the response header as:
Allow:GET,HEAD,POST,OPTIONS,TRACE
Connection:Keep-Alive
Content-Length:0
Content-Type:text/plain; charset=UTF-8
Date:Mon, 07 Jan 2013 16:55:44 GMT
Keep-Alive:timeout=15, max=99
Server:Apache/2.2.3 (CentOS)
What is the matter?

Answer 1

It finally works in PHP, although I still didn't see the difference.
Summary as :
1.
When using perl as:
my $cgi = new CGI;
print $cgi -> header(
-type => 'text/plain',
-access_control_allow_origin => '*',
-access_control_allow_headers => 'content-type,X-Requested-With',
-access_control_allow_methods => 'GET,POST,OPTIONS',
-access_control_allow_credentials => 'true',
);
The HTTP headers as:
Request header:
Request Method:OPTIONS
Status Code:200 OK
Request Headersview source
Accept:*/*
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:origin, x-requested-with, content-type
Access-Control-Request-Method:POST
Connection:keep-alive
Host:example.org
Origin:http://localhost
Referer:http://localhost/testCORS.html
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11
Response header:
Allow:GET,HEAD,POST,OPTIONS,TRACE
Connection:Keep-Alive
Content-Length:0
Content-Type:text/plain; charset=UTF-8
Date:Tue, 08 Jan 2013 05:52:26 GMT
Keep-Alive:timeout=15, max=100
Server:Apache/2.2.3 (CentOS)
2.
BUT in PHP, it works!!!: I didn't see the differences!
code as:
<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET,POST,OPTIONS");
header("Access-Control-Allow-Headers: X-Requested-With,");
#header("Access-Control-Allow-Credentials: true");
?>
Response header :
Access-Control-Allow-Headers:X-Requested-With
Access-Control-Allow-Methods:GET,POST,OPTIONS
Access-Control-Allow-Origin:*
Connection:Keep-Alive
Content-Length:0
Content-Type:text/html; charset=UTF-8
Date:Tue, 08 Jan 2013 05:52:10 GMT
Keep-Alive:timeout=15, max=100
Server:Apache/2.2.3 (CentOS)
X-Powered-By:PHP/5.3.3

Answer 2

You need to make sure that your server is responding to an OPTIONS request to that URL with the proper Access-Control-Allow-Origin header. The browser will "preflight" your request by first making an OPTIONS request. If that fails, it will not try your request at all.