If you have access to both webservers it might be just easier to add the appropriate headers for your situation:
Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:Authorization, X-Requested-With
Access-Control-Allow-Methods:GET, OPTIONS
Access-Control-Allow-Origin:http://your.origin.domain
You'll notice the browser performing 2 request after that: the first is a OPTION type call, the second a GET (in this case)
I only know how to do this -for sure- in nginx, for a live working example see:
http://m.bitless.be/
open the debugger/webtools (in chrome ctrl+shift+i) and check out the XHR section. spot the traffic layer. I've set it up in a way that all domains should be able to access it automatically.
## Only allow OPTIONS and HEAD and GET request methods
if ($request_method ~ ^(OPTIONS|HEAD)$ ) {
add_header Access-Control-Allow-Origin $http_origin;
add_header Access-Control-Allow-Methods "GET, OPTIONS";
add_header Access-Control-Allow-Headers "Authorization, X-Requested-With";
add_header Access-Control-Allow-Credentials "true";
add_header Content-Length 0;
add_header Content-Type text/plain;
return 200;
}
if ($request_method ~ ^(GET)$ ) {
add_header Access-Control-Allow-Origin $http_origin;
add_header Access-Control-Allow-Methods "GET, OPTIONS";
add_header Access-Control-Allow-Headers "Authorization, X-Requested-With";
add_header Access-Control-Allow-Credentials "true";
}
It's an alternative answer for your question: "How can I get this to work". That's how I eventually did it, even after writing my own proxy script, I find this way to suit my goals better, not having to worry about crossdomain restrictions in openlayers.
Needless to say: you need access to all webservers serving layer data.
