# Access-Control-Allow-Headers

**URL:** <https://discussions.flightaware.com/t/access-control-allow-headers/29789>\
**Category:** AeroAPI\
**Created:** [January 2, 2018, 7:14pm UTC](https://discussions.flightaware.com/t/access-control-allow-headers/29789 "2018-01-02T19:14:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![damaco04](https://sea1.discourse-cdn.com/flex019/user_avatar/discussions.flightaware.com/damaco04/32/5930_2.png) [@damaco04](https://discussions.flightaware.com/u/damaco04)\
**Post date:** [January 2, 2018, 7:14pm UTC](https://discussions.flightaware.com/t/access-control-allow-headers/29789/1 "2018-01-02T19:14:25Z")

</div>

Hi I am trying to call a Webservice using AJAX / Jquery, this is my code:

var settings = {  
“async”: true,  
“crossDomain”: true,  
“url”: “[http://flightxml.flightaware.com/json/FlightXML2/Arrived?airport=MRLB](http://flightxml.flightaware.com/json/FlightXML2/Arrived?airport=MRLB)”,  
“method”: “GET”,  
“headers”: {  
“authorization”: “authorization my user and apikey here”,  
“cache-control”: “no-cache”,  
}  
}

$.ajax(settings).done(function (response) {  
console.log(response);  
});

However I am getting this error:

**Request header field cache-control is not allowed by Access-Control-Allow-Headers in preflight response.**

Any ideas how to fix this? I am pretty sure this is a CORS issue.

thanks,  
Danilo

---

<div class="post-metadata">

**Author:** ![bovineone](https://sea1.discourse-cdn.com/flex019/user_avatar/discussions.flightaware.com/bovineone/32/117631_2.png) [@bovineone](https://discussions.flightaware.com/u/bovineone)\
**Post date:** [January 2, 2018, 8:12pm UTC](https://discussions.flightaware.com/t/access-control-allow-headers/29789/2 "2018-01-02T20:12:37Z")

</div>

Although we provide an example for it, we do not recommend usage of FlightXML through AJAX due to the numerous potential security issues associated with this method.