# XMLHttpRequest help

**URL:** <https://forum.freecodecamp.org/t/xmlhttprequest-help/138778>\
**Category:** General\
**Created:** [July 28, 2017, 5:35pm UTC](https://forum.freecodecamp.org/t/xmlhttprequest-help/138778 "2017-07-28T17:35:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivan3123708](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ivan3123708/32/61275_2.png) [@ivan3123708](https://forum.freecodecamp.org/u/ivan3123708)\
**Post date:** [July 28, 2017, 5:35pm UTC](https://forum.freecodecamp.org/t/xmlhttprequest-help/138778/1 "2017-07-28T17:35:16Z")

</div>

Hi all…

I’m working on Wikipedia Viewer and I’m making XMLHttpRequest to get data from Wikipedia API, but I’m getting this error:

XMLHttpRequest cannot load [https://en.wikipedia.org/w/api.php?action=opensearch&search=donald%20trump&format=json&callback=?.](https://en.wikipedia.org/w/api.php?action=opensearch&search=donald%20trump&format=json&callback=?.) No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘null’ is therefore not allowed access.

Could someone explain to me how to set header and what it should look like and why?

I know that it would probably be easier to use jQuery for this but I want to make this with pure JS if possible.

Thanks.

---

<div class="post-metadata">

**Author:** ![ivan3123708](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ivan3123708/32/61275_2.png) [@ivan3123708](https://forum.freecodecamp.org/u/ivan3123708)\
**Post date:** [July 28, 2017, 7:07pm UTC](https://forum.freecodecamp.org/t/xmlhttprequest-help/138778/3 "2017-07-28T19:07:26Z")

</div>

Thank you for the answer and the links!

---

<div class="post-metadata">

**Author:** ![andreiepure](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/andreiepure/32/12116_2.png) [@andreiepure](https://forum.freecodecamp.org/u/andreiepure)\
**Post date:** [August 15, 2017, 2:59pm UTC](https://forum.freecodecamp.org/t/xmlhttprequest-help/138778/4 "2017-08-15T14:59:46Z")

</div>

Thanks, @SkyC.  
I now found the mention in the APISandbox.

_When accessing the API using a cross-domain AJAX request (CORS), set this to the originating domain. This must be included in any pre-flight request, and therefore must be part of the request URI (not the POST body)._

_For authenticated requests, this must match one of the origins in the Origin header exactly, so it has to be set to something like [https://en.wikipedia.org](https://en.wikipedia.org) or [https://meta.wikimedia.org](https://meta.wikimedia.org). If this parameter does not match the Origin header, a 403 response will be returned. If this parameter matches the Origin header and the origin is whitelisted, the Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers will be set._

_For non-authenticated requests, specify the value \*. This will cause the Access-Control-Allow-Origin header to be set, but Access-Control-Allow-Credentials will be false and all user-specific data will be restricted._

---

<div class="post-metadata">

**Author:** ![ILM](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ilm/32/363239_2.png) [@ILM](https://forum.freecodecamp.org/u/ILM)\
**Post date:** [January 17, 2021, 8:42pm UTC](https://forum.freecodecamp.org/t/xmlhttprequest-help/138778/5 "2021-01-17T20:42:28Z")

</div>

Closed on January 17, 2021, 8:42pm UTC