It is not clear to me if CORS headers (Access-Control-Allow-Origin, etc) should be present only on the preflight request (OPTIONS method) or also in the resource's headers (which I'm trying to POST using XHR)
I'm asking this because I installed a python plugin which handles cors by only adding the CORS headers to the OPTIONS method (preflight), but not to the requested resource, this approach is NOT solving the cors issue on chrome and firefox, returning messages like
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [URL]. This can be fixed by moving the resource to the same domain or enabling CORS.
Edit:
I also found more info on http://www.html5rocks.com/en/tutorials/cors/ , which says:
Access-Control-Allow-Origin (required) - This header must be included in all valid CORS responses; omitting the header will cause the CORS request to fail. The value of the header can either echo the Origin request header (as in the example above), or be a '*' to allow requests from any origin. If you’d like any site to be able to access your data, using '*' is fine. But if you’d like finer control over who can access your data, use an actual value in the header.