Access-Control-Allow-Headers about access-control-allow-origin

[mhahmadi]

Access-Control-Allow-Headers cannot be a wildcard
http://www.w3.org/TR/cors/#access-control-allow-headers-response-header

[mhahmadi]

as long as you specify those custom headers in your ajax request your browser should take care of the preflight request invisible to you and the extension should satisfy the browser by setting the Access-Control-Allow-Headers header in the response with the appropriate value.
can you explain in more detail what isn't working here?

[mikehayesuk]

Ok so the problem is I'm working with my API in the browser (assets served on a different port to the API).

I have, as expected, this error:

XMLHttpRequest cannot load http://localhost:8000/api/some/route.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:9000' is therefore not allowed access. 

Then I enable your extension, which resolves the above error but gives further expected errors regarding Access-Control-Allow-Headers:

XMLHttpRequest cannot load http://localhost:8000/api/some/route.
Request header field Cache-Control is not allowed by Access-Control-Allow-Headers. 

I think for the extension to be useful to a lot of people it should resolve this scenario too (if possible). Since the value cannot be a wildcard, perhaps the extension could be configurable to set some headers which need to be in the Access-Control-Allow-Headers value?

In the above case it's actually a pretty common header for forcing proxies etc to give a fresh response. However my application sets various other custom request headers too. At the moment I'm having to launch Chrome with the --disable-web-security flag which is pretty nasty.

[mhahmadi]

the extension is supposed to address this scenario. are you sending lots of requests at the same time (possibly with different custom headers)? I suggest you test your scenario in isolation.

to test the extension I use the following Express snippet for the backend:
https://gist.github.com/mhahmadi/56bfacd1da00f668a90e

and in chrome console:

xmlhttp=new XMLHttpRequest();
xmlhttp.open("GET","http://localhost:3000");
xmlhttp.setRequestHeader('cache-control', 'no-cache');
xmlhttp.send();

[mikehayesuk]

I have updated my local background.js from master and it is now working (although I now have a different issue but that's unrelated to this one).

The background.js packaged with the extension on the Chrome Web Store is out of date then it seems!

Thanks