access-control-allow-origin不起作用

Question

I'm integrating the API system into my website, however I got this message from Google chrome's console: XMLHttpRequest cannot load https://api.mysocialsync.com/. Origin https://www.mysocialsync.com is not allowed by Access-Control-Allow-Origin.

Now luckely I know what that error means and I tried to solve it (also with help of other stackoverflow pages) but none of the solutions worked, even

header("access-control-allow-origin: *");

didn't do the trick.

I'm out of idea's unfortunatly, I hope there is someone here who has an solution to this.

My server is running PHP5 with suhosin.

Answer 1

It's not your website that should be sending the Access-Control-Allow-Origin header, but the website you are requesting (i.e. the MySocialSync API). If the header would work the way you think it does, you could e.g. read a user's private Facebook messages and do other nasty cross-site data requests.

I'd recommend contacting the API creators to have them add the header.