Hello all, trying to get some practice with this API and am currently working on caching the image url data as suggested on this page.

I'm trying to make a Cordova Android app, so I'm using Javascript to request the information. However, in my development environment (which is localhost for the domain) I'm getting the error:

Failed to load https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I'm using the code that is suggested on that page under the Javascript - XMLHttpRequest section which is:

var data = "{}";

var xhr = new XMLHttpRequest();
    xhr.withCredentials = true;

    xhr.addEventListener("readystatechange", function () {
      if (this.readyState === this.DONE) {
        console.log(this.responseText);
      }
    });

    xhr.open("GET", "https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY");

    xhr.send(data);

Due to the nature of the error and it specifically mentioning the "withCredentials", I simply removed the third line in the above code (xhr.withCredentials=true;) and ran the program again, it was successful.

I then restored the withCredentials line and tried to change my htaccess file:

Before

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

Attempt 1

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY"
</IfModule>

Attempt 2

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "http://localhost"
</IfModule>

Both of the attempts resulted in the same error as above. In addition to these attempts I tried to use CORS rather than the standard XML request and it had the same error.

After looking through this forum for related issues, I saw that I should be using JSONP rather than the default configuration, however, I'm a little confused as to why the withCredentials is in the example code yet it doesn't seem to be required, so I have a few questions...

Related threads I read through: Thread 1 Thread 2

Questions

1. Is there any problem with taking out that withCredentials line and simply moving forward with API calls? (any security concerns maybe?)

2. Will using withCredentials on a different domain than localhost work? (is localhost simply limited?)

3. Any specific suggestions for this particular situation going forward?

Thanks in advance, I know that this is long winded, but I didn't want to leave out any details since I've been Googling for a while and seen a lot of the same "fixes" around.

Edit: Layout for easier reading