I used OneLogin User API to log a user in, without MFA, I tried to use the below function which makes cors request to onelogin.com.
function makeCors(session_token) {
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
method = "POST";
var url = "https://admin.us.onelogin.com/mytoken";
xhr.open(method, url, true);
xhr.setRequestHeader("Content-Type", "application/json");
body = {"session_token": session_token};
xhr.send(JSON.stringify(body));
};
This gives the following error
Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource