CORS no Acess-Control-Allow-Origin header

Question

In my Javascript file I want to load xml data from this site: https://www.anime2you.de/feed/

But I always get a no Access-Control-Allow-Origin header despite using CORS. Did I misunderstand the concept / usage of CORS or is the website faulty?

My code:

var feeds = ["https://www.anime2you.de/feed/"];

var createCORSRequest = function(method, url) {
  var xhr = new XMLHttpRequest();
   if ("withCredentials" in xhr) {
   // Most browsers.
    xhr.open(method, url, true);
   } else if (typeof XDomainRequest != "undefined") {
     // IE8 & IE9
       xhr = new XDomainRequest();
       xhr.open(method, url);
   } else {
     // CORS not supported.
       xhr = null;
   }
 return xhr;
};

var url = 'https://www.anime2you.de/feed/';
var method = 'GET';
var xhr = createCORSRequest(method, url);

xhr.onload = function() {
  alert("success");
};

xhr.onerror = function() {
  alert("fail");
};

xhr.send();

Thanks in advance Nova

Answer 1

Have you set the header("Access-Control-Allow-Origin: *"); on the script you are requesting? https://www.anime2you.de/feed/ if you are using Access-Control-Allow-Origin with a wildcard then set the credentials to false in

xhr.withCredentials = false;

If you can set the domain name of the server making the request ie

header("Access-Control-Allow-Origin: http://domain-where-js-sits"); 

then you can do:

xhr.withCredentials = true;

and set these other headers:

Access-Control-Allow-Methods: POST
Access-Control-Allow-Headers: Content-Type 

An alternative is to use jsonp - this may not work for you as the response needs to be in json:

function response(data) {
    edit the returned data here
}

var script = document.createElement('script');
script.src = 'https://www.anime2you.de/feed/?callback-response';
document.body.appendChild(script);