When making a preflight request, ensure that the 'Access-Control-Allow-Origin' header in the response does not use '*' as the value when the request's credentials mode is set to 'include'. This will prevent Origin '' from being granted access. Remember to control the credentials mode of XMLHttpRequest requests using the withCredentials attribute.
var xhrReq = new XMLHttpRequest();
xhrReq.withCredentials = true;
xhrReq.open("GET", "https://lootpaliveapi.snapfulfil.net/api", true, "******", "*******");
xhrReq.setRequestHeader("content-type", "application/json");
xhrReq.setRequestHeader("Access-Control-Allow-Origin", "https://lootpaliveapi.snapfulfil.net");
xhrReq.onload = function(){
console.log("READY STATE", xhrReq.readyState);
if(this.status == 200) {
console.log(this.responseText);
document.getElementById("jsonDat").innerHTML = this.responseText;
}
}
// Send Request to Get Data
xhrReq.send();
Encountering errors while trying to connect to a third-party application server, similar to the one described above.
Prefer implementing through JavaScript and XMLHttpRequest instead of relying on server-side scripts due to specific limitations in accepting server-side solutions.