CORS Access-Control-Allow-Origin despite correct headers

I am trying to set up simple Cross-Origin Resource Sharing using jQuery (1.7.1) powered ajax on the client and apache served python (django) server. According to all the instructions I have read my headers are set correctly, but I keep getting the following error: XMLHttpRequest cannot load http://myexternaldomain.com/get_data. Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin. The header being I am trying to (I am not sure it is even getting past the browser) send is: ``` Request URL:http://myexternaldomain.com/get_data Accept:application/json, text/javascript, */*; q=0.01 Origin:http://localhost:8080 Referer:http://localhost:8080/static/js/test-zetta.html User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.66 Safari/535.11 ``` The javascript code is ``` var request = $.ajax({ url : "http://myexternaldomain.com/get_data", type : "POST", dataType : "json", crossDomain : true }); ``` Note that `origin` is set correctly. The server adds the header `Access-Control-Allow-Origin = *` using the following python code ``` def process_response(self, response): if response.has_header('Access-Control-Allow-Origin'): return response response['Access-Control-Allow-Origin'] = '*' return response def get_orders(request): """ Tell worker what to do """ response_data = {} response_data['action'] = 'probe' response = process_response(HttpResponse(json.dumps(response_data), mimetype="application/json")) return response ``` If I visit the address directly, it appears to confirm that the header is being set correctly ``` Access-Control-Allow-Origin:* Content-Type:application/json Date:Thu, 08 Mar 2012 05:06:25 GMT Server:Apache/2.2.20 (Ubuntu) Transfer-Encoding:chunked ``` However in the cross domain setting it always fails (tried both chrome and firefox). I've tried implementing the code exactly as per the selected answer to this question, but get the same error Update I am quite sure that the problem is server side, as I have managed to get my ajax calls working with a different public CORS enabled server. When I compare the headers coming back from this public server, and the ones returned from mine (when I test from same domain), I cannot see any major difference which could account for difference (see below). One subtlety that I excluded, which may or may be important is that the actual domain is an amazon domain of multiple subdomains. The real address is http://ec2-23-20-27-108.compute-1.amazonaws.com/get_orders , feel free to probe it to see what I am doing wrong. From Public server ``` Access-Control-Allow-Origin:* Connection:Keep-Alive Content-Encoding:gzip Content-Length:622 Content-Type:text/html Date:Thu, 08 Mar 2012 15:33:20 GMT Keep-Alive:timeout=15, max=99 Server:Apache/2.2.14 (Ubuntu) Vary:Accept-Encoding X-Powered-By:Perl/5.8.7, PHP/4.4.0 ``` From my server - (not working cross domain) ``` Access-Control-Allow-Origin:* Content-Encoding:gzip Content-Type:text/plain Date:Thu, 08 Mar 2012 15:32:24 GMT Server:Apache/2.2.20 (Ubuntu) Transfer-Encoding:chunked Vary:Accept-Encoding ```