Access-Control-Allow-Headers does not allow * as accepted value, see the Mozilla Documentation here. Instead of the asterisk, you should send the accepted headers (first X-Requested-With as the error says).