Access-Control-Allow-Origin Not Being Recognized

Question

I'm writing this node.js app and I've got a weird situation:

This snippet of Angularjs...

// delete hosts
$scope.delete = function(row) {
    var rowData = {
        hostname: row.hostname,
        ipaddr: row.ipAddress,
        location: row.location,
        vp: row.vp,
        virthost: row.virtHost,
        services: row.services
    };

    var delurl = "http://10.2.201.6:666/deleteserver";
    var jdata = "mydata="+JSON.stringify(rowData);

    $http({
        method: method,
        url: delurl,
        data: jdata,
        //headers: {'Content-Type': 'application/x-www-form-urlencoded'},
        cache: $templateCache
    }).
    success(function(response) {
        console.log("success");
        $scope.codeStatus = response.data;
        console.log($scope.codeStatus);
    }).
    error(function(response){
        console.log("error");
        $scope.codeStatus = response || "Request failed";
        console.log($scope.codeStatus);
    });
    $scope.list();
    return false;

};

is calling this node.js bit...

//// DELETE
app.delete('/deleteserver', function (req, res) {
    console.log("DELETE: ");
    res.header("Access-Control-Allow-Origin", "http://10.2.201.6");
    res.header("Access-Control-Allow-Methods", "GET, POST");

    console.log(req.body);
    console.log(req.body.mydata);
    var row = JSON.parse(req.body.mydata);

    db.servers.remove(row, function(err, result) {
        if(err) { throw err; }
        res.end(console.log("Record deleted"));
    });


});

But for some reason I'm getting the following errors in my console:

XMLHttpRequest cannot load http://10.2.201.6:666/deleteserver. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://10.2.201.6' is therefore not allowed access.

I've banged my head against a wall, a desk, and a window trying to figure out why the "Access-Control-Allow-Origin" is being ignored. Yes, the listen on port 666 is normal. In fact, my GET and POST methods have the same res.header(...) code and they work brilliantly. Any help would be greatly appreciated!

Answer 1

Don't you need to add DELETE to res.header("Access-Control-Allow-Methods", "GET, POST");

Also, don't you want res.send not res.end?