I'm making a JSON request to the Google Places API with:

    function load(){

    var req = new XMLHttpRequest();

    req.open('GET', ';sensor=true&key=xxxxxxxxxxxxx', false);

    req.send(null);

    if(req.status == 200){  

      dump(req.responseText);

        }
}

But Chrome is returning the error:

XMLHttpRequest cannot load ;sensor=true&key=xxxxxxxxxxxxxx. 
Origin  is not allowed by Access-Control-Allow-Origin.

Is there a way to prevent or circumvent cross-origin resource sharing? I am not very familiar with this security issue.

I'm making a JSON request to the Google Places API with:

    function load(){

    var req = new XMLHttpRequest();

    req.open('GET', 'https://maps.googleapis./maps/api/place/details/json?reference=CnRhAAAARMUGgu2CeASdhvnbS40Y5y5wwMIqXKfL-n90TSsPvtkdYinuMQfA2gZTjFGuQ85AMx8HTV7axABS7XQgFKyzudGd7JgAeY0iFAUsG5Up64R5LviFkKMMAc2yhrZ1lTh9GqcYCOhfk2b7k8RPGAaPxBIQDRhqoKjsWjPJhSb_6u2tIxoUsGJsEjYhdRiKIo6eow2CQFw5W58&sensor=true&key=xxxxxxxxxxxxx', false);

    req.send(null);

    if(req.status == 200){  

      dump(req.responseText);

        }
}

But Chrome is returning the error:

XMLHttpRequest cannot load https://maps.googleapis./maps/api/place/details/json?reference=CnRhAAAARMUGgu2CeASdhvnbS40Y5y5wwMIqXKfL-n90TSsPvtkdYinuMQfA2gZTjFGuQ85AMx8HTV7axABS7XQgFKyzudGd7JgAeY0iFAUsG5Up64R5LviFkKMMAc2yhrZ1lTh9GqcYCOhfk2b7k8RPGAaPxBIQDRhqoKjsWjPJhSb_6u2tIxoUsGJsEjYhdRiKIo6eow2CQFw5W58&sensor=true&key=xxxxxxxxxxxxxx. 
Origin http://sandrayoon. is not allowed by Access-Control-Allow-Origin.

Is there a way to prevent or circumvent cross-origin resource sharing? I am not very familiar with this security issue.

• javascript
• json
• xmlhttprequest
• cross-domain

• The answer is irrelevant to the question – Ila Commented Aug 22, 2017 at 6:21

2 Answers 2

The only way to prevent this is to send proper Access-Control-Allow-Origin header from the server, which isn't under your control. So the basic answer is no. However you can consider using a server proxy, which would grab data from the server and send it to you from the same host as your client script was served.

Server should response with "Access-Control-Allow-Origin" header in order to let the browser to pass this response to javascript. You can also set "*" to allow any cross-domain requests.

Here is a good intro to the subject.