Those headers will allow you to call API methods from web browsers, they require CORS:
            https://en.wikipedia.org/wiki/Cross-origin_resource_sharing
511641
def _setHeaders(self, request):
        
        request.responseHeaders.addRawHeader(b'content-type', b'application/json')
        request.responseHeaders.addRawHeader(b'Access-Control-Allow-Origin', b'*')
        request.responseHeaders.addRawHeader(b'Access-Control-Allow-Methods', b'GET, POST, PUT, DELETE')
        request.responseHeaders.addRawHeader(b'Access-Control-Allow-Headers', b'x-prototype-version,x-requested-with')
        request.responseHeaders.addRawHeader(b'Access-Control-Max-Age', 2520)
        return request
583501
def _add_cors(self):
        

        INVALID_ERROR = "Invalid value for 'Cors' property"

        if not self.cors:
            return

        if self.cors and not self.definition_body:
            raise InvalidResourceException(self.logical_id,
                                           "Cors works only with inline Swagger specified in "
                                           "'DefinitionBody' property")

        if isinstance(self.cors, string_types) or is_instrinsic(self.cors):
            # Just set Origin property. Others will be defaults
            properties = CorsProperties(AllowOrigin=self.cors)
        elif isinstance(self.cors, dict):

            # Make sure keys in the dict are recognized
            if not all(key in CorsProperties._fields for key in self.cors.keys()):
                raise InvalidResourceException(self.logical_id, INVALID_ERROR)

            properties = CorsProperties(**self.cors)

        else:
            raise InvalidResourceException(self.logical_id, INVALID_ERROR)

        if not SwaggerEditor.is_valid(self.definition_body):
            raise InvalidResourceException(self.logical_id, "Unable to add Cors configuration because "
                                                            "'DefinitionBody' does not contain a valid Swagger")

        if properties.AllowCredentials is True and properties.AllowOrigin == _CORS_WILDCARD:
            raise InvalidResourceException(self.logical_id, "Unable to add Cors configuration because "
                                                            "'AllowCredentials' can not be true when "
                                                            "'AllowOrigin' is \"'*'\" or not set")

        editor = SwaggerEditor(self.definition_body)
        for path in editor.iter_on_path():
            editor.add_cors(path, properties.AllowOrigin, properties.AllowHeaders, properties.AllowMethods,
                            max_age=properties.MaxAge, allow_credentials=properties.AllowCredentials)

        # Assign the Swagger back to template
        self.definition_body = editor.swagger
1299049
public static Map<String,String> buildHeaders( String reqCorsHeader, String requestUri ) {

		Map<String,String> result = new LinkedHashMap<> ();
		result.put( CORS_ALLOW_ORIGIN, requestUri );
		result.put( CORS_ALLOW_METHODS, VALUE_ALLOWED_METHODS );
		result.put( CORS_ALLOW_CREDENTIALS, VALUE_ALLOW_CREDENTIALS );

		if( ! Utils.isEmptyOrWhitespaces( reqCorsHeader ))
			result.put( CORS_ALLOW_HEADERS, reqCorsHeader );

		return result;
	}
106004
function header (request) {

    var headers = assign({}, Http.headers.common,
        !request.crossOrigin ? Http.headers.custom : {},
        Http.headers[toLower(request.method)]
    );

    each(headers, function (value, name) {
        if (!request.headers.has(name)) {
            request.headers.set(name, value);
        }
    });

}
1210994
def invoke_api_call(api_call)
      url = URI.parse(api_call[:url])
      http = Net::HTTP.new(url.host, url.port)
      http.use_ssl = true
			http.verify_mode = OpenSSL::SSL::VERIFY_NONE

      # Concatenate parameters to form data
      data = api_call[:params].to_a.map{|pair| pair.map{|x| URI.escape(x.to_s)}.join '='}.join('&')
      headers = {
        'Content-Type' => 'application/x-www-form-urlencoded'
      }

      RubyDesk.logger.info "URL: #{api_call[:url]}"
      RubyDesk.logger.info "method: #{api_call[:method]}"
      RubyDesk.logger.info "Params: #{data}"

      case api_call[:method]
        when :get, 'get' then
          resp, data = http.request(Net::HTTP::Get.new(url.path+"?"+data, headers))
        when :post, 'post' then
          resp, data = http.request(Net::HTTP::Post.new(url.path, headers), data)
        when :delete, 'delete' then
          resp, data = http.request(Net::HTTP::Delete.new(url.path, headers), data)
      end

      RubyDesk.logger.info "Response code: #{resp.code}"
      RubyDesk.logger.info "Returned data: #{data}"

      case resp.code
        when "200" then return data
        when "400" then raise RubyDesk::BadRequest, data
        when "401", "403" then raise RubyDesk::UnauthorizedError, data
        when "404" then raise RubyDesk::PageNotFound, data
        when "500" then raise RubyDesk::ServerError, data
        else raise RubyDesk::Error, data
      end

    end
1123399
def _api_call(self, endpoint, model=None, method=None, data=None, filters=None):
        
        if not self.token:
            raise RuntimeError("You do not have an API token!")

        if not method:
            raise ValueError("Method is required for API calls!")

        if model:
            endpoint = endpoint.format(**vars(model))
        url = '{}{}'.format(self.base_url, endpoint)
        headers = {
            'Authorization': "Bearer {}".format(self.token),
            'Content-Type': 'application/json',
            'User-Agent': self._user_agent,
        }

        if filters:
            headers['X-Filter'] = json.dumps(filters)

        body = None
        if data is not None:
            body = json.dumps(data)

        response = method(url, headers=headers, data=body)

        warning = response.headers.get('Warning', None)
        if warning:
            logger.warning('Received warning from server: {}'.format(warning))

        if 399 < response.status_code < 600:
            j = None
            error_msg = '{}: '.format(response.status_code)
            try:
                j = response.json()
                if 'errors' in j.keys():
                    for e in j['errors']:
                        error_msg += '{}; '.format(e['reason']) \
                                if 'reason' in e.keys() else ''
            except:
                pass
            raise ApiError(error_msg, status=response.status_code, json=j)

        if response.status_code != 204:
            j = response.json()
        else:
            j = None # handle no response body

        return j
1363453
function(req, res, next) {
                    if (req.headers.origin === undefined) {
                        res.setHeader('Access-Control-Allow-Origin', "*");
                    } else {
                        res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
                    }
                    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                    console.log(req.method + " on " + req.originalUrl);
                    if (req.method === "OPTIONS") {
                        res.setHeader('Access-Control-Allow-Headers', 'content-type');
                        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                        res.setHeader('Content-Length', '0');
                        res.setHeader('Content-Type', 'application/json; charset=utf-8');
                        grunt.file.read(req.originalUrl.split("?")[0]);
                        //res.write(body);
                        res.end("200");
                        //next();
                    } else {
                        next();
                    }
                }
1345630
function corsHeaders (req, res, next) {
  // Get the default CORS response headers as specified in the Swagger API
  let responseHeaders = getResponseHeaders(req);

  // Set each CORS header
  _.each(accessControl, (header) => {
    if (responseHeaders[header] !== undefined) {
      // Set the header to the default value from the Swagger API
      res.set(header, responseHeaders[header]);
    }
    else {
      // Set the header to a sensible default
      switch (header) {
        case accessControl.allowOrigin:
          // By default, allow the origin host. Fallback to wild-card.
          res.set(header, req.get("Origin") || "*");
          break;

        case accessControl.allowMethods:
          if (req.swagger && req.swagger.path) {
            // Return the allowed methods for this Swagger path
            res.set(header, util.getAllowedMethods(req.swagger.path));
          }
          else {
            // By default, allow all of the requested methods. Fallback to ALL methods.
            res.set(header, req.get("Access-Control-Request-Method") || swaggerMethods.join(", ").toUpperCase());
          }
          break;

        case accessControl.allowHeaders:
          // By default, allow all of the requested headers
          res.set(header, req.get("Access-Control-Request-Headers") || "");
          break;

        case accessControl.allowCredentials:
          // By default, allow credentials
          res.set(header, true);
          break;

        case accessControl.maxAge:
          // By default, access-control expires immediately.
          res.set(header, 0);
          break;
      }
    }
  });

  if (res.get(accessControl.allowOrigin) === "*") {
    // If Access-Control-Allow-Origin is wild-carded, then Access-Control-Allow-Credentials must be false
    res.set("Access-Control-Allow-Credentials", "false");
  }
  else {
    // If Access-Control-Allow-Origin is set (not wild-carded), then "Vary: Origin" must be set
    res.vary("Origin");
  }

  next();
}
265291
function corsPrefetch(req, res, next) {
	res.header('Access-Control-Allow-Origin', req.headers.origin);
	res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
	res.header('Access-Control-Allow-Headers', 'Content-Type, *');
	res.setHeader('Access-Control-Allow-Credentials', 'true');

	if (req.method === 'OPTIONS') {
		res.sendStatus(200);
		return;
	}

	next();
}
371730
def post(self, url, data, charset=CHARSET_UTF8, headers={}):
        ''''''
        if 'Api-Lang' not in headers:
            headers['Api-Lang'] = 'python'
        if 'Content-Type' not in headers:
            headers['Content-Type'] = "application/x-www-form-urlencoded;charset=" + charset
        rsp = requests.post(url, data, headers=headers,
                            timeout=(int(self.conf(HTTP_CONN_TIMEOUT, '10')), int(self.conf(HTTP_SO_TIMEOUT, '30'))))
        return json.loads(rsp.text)
1249421
public function api_respond() {
		// Is a data response type not defined or not available?
		if ( !isset($this->response->type) || !array_key_exists($this->response->type, $this->config['rest']['mime_types']) ) {
			// Use a short-style ternary (PHP 5.3) to either grab the default or use this hard-coded default
			$this->response->type = $this->config['rest']['defaults']['data_type'] ?: 'json';
		}

		// Set our data response header
		$this->response->header( 'Content-Type', $this->config['rest']['mime_types'][$this->response->type] );

		// Set our allowed methods response header
		if ( !is_null( $this->response->possible_methods ) ) {
			$this->response->header( 'Allow', implode( ', ', $this->response->possible_methods ) );
		}

		// Send our access control headers
		$this->response->header( 'Access-Control-Allow-Headers', $this->config['rest']['http_access_control']['allow_headers']);
		$this->response->header( 'Access-Control-Allow-Methods', $this->config['rest']['http_access_control']['allow_methods']);
		$this->response->header( 'Access-Control-Allow-Origin', $this->config['rest']['http_access_control']['allow_origin']);

		// Let's build our response data
		$response_data = new stdClass();
		$response_data->meta = (object) array(
			'status_code' => (int) $this->response->code(),
			'status' => (string) $this->get_status(),
			'message' => (string) $this->response->message ?: (string) null,
			'more_info' => $this->response->more_info ?: (object) null,
		);
		$response_data->data = $this->response->data ?: (object) null;

		// Only add paging data if it exists
		if ( isset($this->response->paging) ) {
			$response_data->paging = $this->response->paging;
		}

		// If global template processing is turned on
		if ( $this->config['template']['global_template_processing'] ) {
			// If we only want to process our returned "data"
			if ( $this->config['template']['only_process_returned_data'] ) {
				// Set our data to be processed as the "data" property of our response data
				$raw_data = &$response_data->data;
			}
			else {
				// Otherwise, set our raw data as our entire response data object
				$raw_data = &$response_data;
			}

			// Process our data for templating
			$raw_data = $this->process_template( $raw_data );
		}

		// Let's encode our response based on our set type
		if ( $this->response->type == 'json' ) {
			$this->response->json( $response_data );
		}
		elseif ( $this->response->type == 'jsonp' ) {
			$this->response->json( $response_data, $this->config['rest']['defaults']['jsonp_padding'] ?: 'callback' );
		}
		// If all else fails, just var_dump
		else {
			var_dump( $response_data );
		}

		// Finally, should we include our execution time header?
		if ( defined( 'PAULUS_ALLOW_BENCHMARK_HEADER' ) === true ) {
			// If our benchmark header is set to true
			if ( $this->request->header( PAULUS_BENCHMARK_HEADER_NAME, false ) ) {
				// Set our benchmark header to the time difference between the app start and now
				$this->response->header(
					PAULUS_BENCHMARK_HEADER_NAME,
					( microtime( true) - PAULUS_START_TIME )
				);
			}
		}
		// If its been flagged to always show
		elseif ( defined( 'PAULUS_BENCHMARK_ALWAYS' ) === true ) {
			// Set our benchmark header to the time difference between the app start and now
			$this->response->header(
				PAULUS_BENCHMARK_HEADER_NAME,
				( microtime( true) - PAULUS_START_TIME )
			);
		}

		// We need to EXIT here, since we want this to be our last output
		// ... but be able to turn it off...
		if ( isset( $this->config['rest']['exit_after_rest_response'] ) && $this->config['rest']['exit_after_rest_response'] ) {
			exit;
		}
	}
111370
function http($url, $method, $postfields = NULL, $headers = array()) {
        $this->http_info = array();
        $ci = curl_init();
        /* Curl settings */
        curl_setopt($ci, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
        curl_setopt($ci, CURLOPT_USERAGENT, $this->useragent);
        curl_setopt($ci, CURLOPT_CONNECTTIMEOUT, $this->connecttimeout);
        curl_setopt($ci, CURLOPT_TIMEOUT, $this->timeout);
        curl_setopt($ci, CURLOPT_RETURNTRANSFER, TRUE);
        curl_setopt($ci, CURLOPT_ENCODING, "");
        curl_setopt($ci, CURLOPT_SSL_VERIFYPEER, $this->ssl_verifypeer);
        if (version_compare(phpversion(), '5.4.0', '<')) {
            curl_setopt($ci, CURLOPT_SSL_VERIFYHOST, 1);
        } else {
            curl_setopt($ci, CURLOPT_SSL_VERIFYHOST, 2);
        }
        curl_setopt($ci, CURLOPT_HEADERFUNCTION, array($this, 'getHeader'));
        curl_setopt($ci, CURLOPT_HEADER, FALSE);

        switch ($method) {
            case 'POST':
                curl_setopt($ci, CURLOPT_POST, TRUE);
                if (!empty($postfields)) {
                    curl_setopt($ci, CURLOPT_POSTFIELDS, $postfields);
                    $this->postdata = $postfields;
                }
                break;
            case 'DELETE':
                curl_setopt($ci, CURLOPT_CUSTOMREQUEST, 'DELETE');
                if (!empty($postfields)) {
                    $url = "{$url}?{$postfields}";
                }
        }

        curl_setopt($ci, CURLOPT_URL, $url );
        curl_setopt($ci, CURLOPT_HTTPHEADER, $headers );
        curl_setopt($ci, CURLINFO_HEADER_OUT, TRUE );

        $response = curl_exec($ci);
        $this->http_code = curl_getinfo($ci, CURLINFO_HTTP_CODE);
        $this->http_info = array_merge($this->http_info, curl_getinfo($ci));
        $this->url = $url;

        if ($this->debug) {
            echo "=====post data======\r\n";
            var_dump($postfields);

            echo "=====headers======\r\n";
            print_r($headers);

            echo '=====request info====='."\r\n";
            print_r( curl_getinfo($ci) );

            echo '=====response====='."\r\n";
            print_r( $response );
        }
        curl_close ($ci);
        return $response;
    }
662273
function() {
      if( StackMob['useRelativePathForAjax'] ){
        // Build "relative path" (also used for OAuth signing)
        return StackMob.apiDomain ? StackMob.apiDomain : (this.getHostname() + (this.getPort() ? ':' + this.getPort() : '')) + '/';
      } else {
        // Use absolute path and operate through CORS
        return StackMob.apiDomain ? StackMob.apiDomain : (StackMob['API_SERVER'] + '/');
      }
    }
751980
async def _preflight_handler(self, request: web.Request):
        """"""

        # Handle according to part 6.2 of the CORS specification.

        origin = request.headers.get(hdrs.ORIGIN)
        if origin is None:
            # Terminate CORS according to CORS 6.2.1.
            raise web.HTTPForbidden(
                text="CORS preflight request failed: "
                     "origin header is not specified in the request")

        # CORS 6.2.3. Doing it out of order is not an error.
        request_method = self._parse_request_method(request)

        # CORS 6.2.5. Doing it out of order is not an error.

        try:
            config = \
                await self._get_config(request, origin, request_method)
        except KeyError:
            raise web.HTTPForbidden(
                text="CORS preflight request failed: "
                     "request method {!r} is not allowed "
                     "for {!r} origin".format(request_method, origin))

        if not config:
            # No allowed origins for the route.
            # Terminate CORS according to CORS 6.2.1.
            raise web.HTTPForbidden(
                text="CORS preflight request failed: "
                     "no origins are allowed")

        options = config.get(origin, config.get("*"))
        if options is None:
            # No configuration for the origin - deny.
            # Terminate CORS according to CORS 6.2.2.
            raise web.HTTPForbidden(
                text="CORS preflight request failed: "
                     "origin '{}' is not allowed".format(origin))

        # CORS 6.2.4
        request_headers = self._parse_request_headers(request)

        # CORS 6.2.6
        if options.allow_headers == "*":
            pass
        else:
            disallowed_headers = request_headers - options.allow_headers
            if disallowed_headers:
                raise web.HTTPForbidden(
                    text="CORS preflight request failed: "
                         "headers are not allowed: {}".format(
                             ", ".join(disallowed_headers)))

        # Ok, CORS actual request with specified in the preflight request
        # parameters is allowed.
        # Set appropriate headers and return 200 response.

        response = web.Response()

        # CORS 6.2.7
        response.headers[hdrs.ACCESS_CONTROL_ALLOW_ORIGIN] = origin
        if options.allow_credentials:
            # Set allowed credentials.
            response.headers[hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS] = _TRUE

        # CORS 6.2.8
        if options.max_age is not None:
            response.headers[hdrs.ACCESS_CONTROL_MAX_AGE] = \
                str(options.max_age)

        # CORS 6.2.9
        # TODO: more optimal for client preflight request cache would be to
        # respond with ALL allowed methods.
        response.headers[hdrs.ACCESS_CONTROL_ALLOW_METHODS] = request_method

        # CORS 6.2.10
        if request_headers:
            # Note: case of the headers in the request is changed, but this
            # shouldn't be a problem, since the headers should be compared in
            # the case-insensitive way.
            response.headers[hdrs.ACCESS_CONTROL_ALLOW_HEADERS] = \
                ",".join(request_headers)

        return response
1169328
function isCrossOriginXhrSupported() {
        if (window.XMLHttpRequest) {
            var xhr = qq.createXhrInstance();

            //Commonly accepted test for XHR CORS support.
            return xhr.withCredentials !== undefined;
        }

        return false;
    }
1308218
async def _on_response_prepare(self,
                                   request: web.Request,
                                   response: web.StreamResponse):
        
        if (not self._router_adapter.is_cors_enabled_on_request(request) or
                self._router_adapter.is_preflight_request(request)):
            # Either not CORS enabled route, or preflight request which is
            # handled in its own handler.
            return

        # Processing response of non-preflight CORS-enabled request.

        config = self._router_adapter.get_non_preflight_request_config(request)

        # Handle according to part 6.1 of the CORS specification.

        origin = request.headers.get(hdrs.ORIGIN)
        if origin is None:
            # Terminate CORS according to CORS 6.1.1.
            return

        options = config.get(origin, config.get("*"))
        if options is None:
            # Terminate CORS according to CORS 6.1.2.
            return

        assert hdrs.ACCESS_CONTROL_ALLOW_ORIGIN not in response.headers
        assert hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS not in response.headers
        assert hdrs.ACCESS_CONTROL_EXPOSE_HEADERS not in response.headers

        # Process according to CORS 6.1.4.
        # Set exposed headers (server headers exposed to client) before
        # setting any other headers.
        if options.expose_headers == "*":
            # Expose all headers that are set in response.
            exposed_headers = \
                frozenset(response.headers.keys()) - _SIMPLE_RESPONSE_HEADERS
            response.headers[hdrs.ACCESS_CONTROL_EXPOSE_HEADERS] = \
                ",".join(exposed_headers)

        elif options.expose_headers:
            # Expose predefined list of headers.
            response.headers[hdrs.ACCESS_CONTROL_EXPOSE_HEADERS] = \
                ",".join(options.expose_headers)

        # Process according to CORS 6.1.3.
        # Set allowed origin.
        response.headers[hdrs.ACCESS_CONTROL_ALLOW_ORIGIN] = origin
        if options.allow_credentials:
            # Set allowed credentials.
            response.headers[hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS] = _TRUE
1086909
function _createXhr(method, url, options) {
    var xhr = new XMLHttpRequest();

    xhr.open(method, url);

    // Setup headers, including the *Authorization* that holds the Api Key.
    for (var header in options.headers) {
      if (options.headers.hasOwnProperty(header)) {
        xhr.setRequestHeader(header, options.headers[header]);
      }
    }

    // Set timeout.
    if (options.timeout > 0) {
      xhr.timeout = options.timeout;
    }

    return xhr;
  }