{"action":"closed","issue":{"url":"https://api.github.com/repos/neo4j/neo4j/issues/4835","labels_url":"https://api.github.com/repos/neo4j/neo4j/issues/4835/labels{/name}","comments_url":"https://api.github.com/repos/neo4j/neo4j/issues/4835/comments","events_url":"https://api.github.com/repos/neo4j/neo4j/issues/4835/events","html_url":"https://github.com/neo4j/neo4j/issues/4835","id":88750900,"number":4835,"title":"CORS headers prohibit AJAX requests","user":{"login":"lericson","id":46901,"avatar_url":"https://avatars.githubusercontent.com/u/46901?v=3","gravatar_id":"","url":"https://api.github.com/users/lericson","html_url":"https://github.com/lericson","followers_url":"https://api.github.com/users/lericson/followers","following_url":"https://api.github.com/users/lericson/following{/other_user}","gists_url":"https://api.github.com/users/lericson/gists{/gist_id}","starred_url":"https://api.github.com/users/lericson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lericson/subscriptions","organizations_url":"https://api.github.com/users/lericson/orgs","repos_url":"https://api.github.com/users/lericson/repos","events_url":"https://api.github.com/users/lericson/events{/privacy}","received_events_url":"https://api.github.com/users/lericson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/neo4j/neo4j/labels/server","name":"server","color":"207de5"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-16T14:53:13Z","updated_at":"2015-06-27T15:17:18Z","closed_at":"2015-06-27T15:17:18Z","body":"It turns out that if an `XmlHttpRequest` specifies an authorization header, the `Access-Control-Allow-Origin` *must not* be the wildcard, `*`, which Neo4j sets unconditionally in `community/server/src/main/java/org/neo4j/server/rest/web/AllowAjaxFilter.java`.\r\n\r\nOne solution might be to allow specifying this header's value, with a default value of `*` to preserve current behaviors for existing installations."}}