recursal/MDN huggingface dataset:
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
=========================================================================

Reason
------
```

Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
```

What went wrong?
----------------

 The response to the CORS request that was sent by the server includes
 an `Access-Control-Allow-Headers` header which includes at least one
 invalid header name.

 The `Access-Control-Allow-Headers` header is sent by the server in response
 to a preflight request; it lets the client know which HTTP headers are permitted in CORS requests.
 If the client user agent finds among the comma-delineated values
 provided by the header any header name it does not recognize, this error occurs.

 This is a problem that most likely can only be fixed on the server side, by modifying
 the server's configuration to no longer send the invalid or unknown header name with the
 `Access-Control-Allow-Headers` header. It may also be worth checking to
 ensure that the user agent or HTTP library you're using on the client is up-to-date.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* HTTP headers
Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
======================================================================

Reason
------
```

Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
```

What went wrong?
----------------

The origin making the request does not match the origin permitted by the `Access-Control-Allow-Origin` header. This error can also occur if the response includes more than one `Access-Control-Allow-Origin` header.

 If the service your code is accessing uses a CORS request under your control, make
 sure it is configured to include your origin in its `Access-Control-Allow-Origin` header. In addition, confirm that only one such header is
 included in responses, and that it includes only a single origin.

 For example, in Apache, add a line such as the following to the server's configuration
 (within the appropriate `<Directory>`, `<Location>`,
 `<Files>`, or `<VirtualHost>` section). The
 configuration is typically found in a `.conf` file (`httpd.conf`
 and `apache.conf` are common names for these), or in an
 `.htaccess` file.

**Warning:** You must include the HTTPS or HTTP protocol as part of the origin.


```apacheconf
Header set Access-Control-Allow-Origin 'origin'
```


For Nginx, the command to set up this header is:


```nginx
add_header 'Access-Control-Allow-Origin' 'origin'
```

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* Enable CORS: I want to add CORS support to my server
Reason: CORS request not HTTP
=============================

Reason
------
```

Reason: CORS request not HTTP
```

What went wrong?
----------------

CORS requests may only use the HTTP or HTTPS URL scheme, but the URL specified by the request is of a different type.
 This often occurs if the URL specifies a local file, using the `file:///` scheme.

To fix this problem, make sure you use HTTPS URLs when issuing requests involving CORS, such as `fetch()`, `XMLHttpRequest`, Web Fonts (`@font-face`), and WebGL textures, and XSL stylesheets.

### Loading a local file

 Local files from the same directory and subdirectories were historically treated as being from the same origin.
 This meant that a file and all its resources could be loaded from a local directory or subdirectory during testing, without triggering a CORS error.

 Unfortunately this had security implications, as noted in this advisory: CVE-2019-11730.
 Many browsers, including Firefox and Chrome, now treat all local files as having *opaque origins* (by default).
 As a result, loading a local file with included local resources will now result in CORS errors.

 Developers who need to perform local testing should now set up a local server.
 As all files are served from the same scheme and domain (`localhost`) they all have the same origin, and do not trigger cross-origin errors.

**Note:** This change is in line with the URL specification, which leaves the origin behavior for files to the implementation, but recommends that file origins are treated as opaque if in doubt.

See also
--------

* CORS errors
* CORS introduction
* What is a URL?
Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '\*'
============================================================================================

Reason
------
```

Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
```

What went wrong?
----------------

The CORS request was attempted with the credentials flag set, but the server is configured using the wildcard (`"*"`) as the value of `Access-Control-Allow-Origin`, which doesn't allow the use of credentials.

To correct this problem on the client side, ensure that the credentials flag's value is `false` when issuing your CORS request.

* If using the Fetch API, make sure `Request.credentials` is `"omit"`.
* If the request is being issued using `XMLHttpRequest`, make sure you're not setting `withCredentials` to `true`.
* If using Server-sent events, make sure `EventSource.withCredentials` is `false` (it's the default value).

If, instead, you need to adjust the server's behavior, you'll need to change the value of `Access-Control-Allow-Origin` to grant access to the origin from which the client is loaded.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
=========================================================================

Reason
------
```

Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
```

What went wrong?
----------------

 The CORS request requires that the server permit the use of
 credentials, but the server's `Access-Control-Allow-Credentials`
 header's value isn't set to `true` to enable their use.

 To fix this problem on the client side, revise the code to not request the use of
 credentials.

* If using the Fetch API, make sure
 `Request.credentials` is `"omit"`.
* If the request is being issued using `XMLHttpRequest`, make sure you're
 not setting `withCredentials` to
 `true`.
* If using Server-sent events,
 make sure `EventSource.withCredentials` is `false` (it's the
 default value).

 To eliminate this error by changing the server's configuration, adjust the server's
 configuration to set the `Access-Control-Allow-Credentials` header's value to
 `true`.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: CORS preflight channel did not succeed
==============================================

Reason
------
```

Reason: CORS preflight channel did not succeed
```

What went wrong?
----------------

 The CORS request requires preflight, preflighting could not be
 performed. There are a couple of reasons why preflighting might fail:

* A cross-site request has previously been performed that already did a preflight, and
 doing the preflight again is not permitted. Make sure your code only preflights once
 per connection.
* The preflight request suffered any kind of networking error that might ordinarily
 occur.
See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
=====================================================================================================

Reason
------
```

Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
```

What went wrong?
----------------

The `Access-Control-Allow-Headers` header is sent by the server to let the client know which headers it supports for CORS requests. The value of `Access-Control-Allow-Headers` should be a comma-delineated list of header names, such as "`X-Custom-Information`" or any of the standard but non-basic header names (which are always allowed).

This error occurs when attempting to preflight a header that is not expressly allowed (that is, it's not included in the list specified by the `Access-Control-Allow-Headers` header sent by the server). To fix this, the server needs to be updated so that it allows the indicated header, or you need to avoid using that header.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* HTTP headers
Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
=========================================================================

Reason
------
```

Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
```

What went wrong?
----------------

 The HTTP method being used by the CORS request is not included in the
 list of methods specified by the response's
 `Access-Control-Allow-Methods` header. This header specifies a
 comma-delimited list of the HTTP methods which may be used when using CORS to access
 the URL specified in the request; if the request is using any other method, this error
 occurs.

For example, if the response includes:


```http
Access-Control-Allow-Methods: GET,HEAD,POST
```


Trying to use a `PUT` request will fail with this error.

Make sure your code only uses the permitted HTTP methods when accessing the service.

**Note:** If the server includes any unrecognized or undefined method names in its `Access-Control-Allow-methods` header, a different error occurs: `Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'`.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* HTTP request methods
Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
======================================================================

Reason
------
```

Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
```

What went wrong?
----------------

 More than one `Access-Control-Allow-Origin` header was sent by the
 server. This isn't allowed.

 If you have access to the server you can change your implementation to echo back an
 origin in the `Access-Control-Allow-Origin` header. You cannot send back a
 list of origins, because browsers only accept a value that is either a single origin or
 null

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* Enable CORS: I want to add CORS support to my server
Reason: CORS request external redirect not allowed
==================================================

Reason
------
```

Reason: CORS request external redirect not allowed
```

What went wrong?
----------------

 The CORS request was responded to by the server with an HTTP redirect
 to a URL on a different origin than the original request, which is not permitted during
 CORS requests.

 For example, if the page `https://service.tld/fetchdata` were requested, and
 the HTTP response is "301 Moved Permanently", "307 Temporary Redirect", or "308
 Permanent Redirect" with a `Location` of
 `https://anotherservice.net/getdata`, the CORS request will fail in this
 manner.

 To fix the problem, update your code to use the new URL as reported by the redirect,
 thereby avoiding the redirect.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
=========================================================================

Reason
------
```

Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
```

What went wrong?
----------------

 The response to the CORS request that was sent by the server includes
 an `Access-Control-Allow-Methods` header which includes at least one
 invalid method name.

 The `Access-Control-Allow-Methods` header is sent by the server to let the
 client know what HTTP request methods it
 supports for CORS requests. The header's value is a comma-delineated string of HTTP
 method names, such as `GET`, `POST`, or
 `HEAD`. If any of the specified values are not recognized by the client
 user agent, this error occurs.

 This is a problem that most likely can only be fixed on the server side, by modifying
 the server's configuration to no longer send the invalid or unknown method name with the
 `Access-Control-Allow-Methods` header. It may also be worth checking to
 ensure that the user agent or HTTP library you're using on the client is up-to-date.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
* HTTP request methods
Reason: CORS header 'Access-Control-Allow-Origin' missing
=========================================================

Reason
------
```

Reason: CORS header 'Access-Control-Allow-Origin' missing
```

What went wrong?
----------------

 The response to the CORS request is missing the required
 `Access-Control-Allow-Origin` header, which is used to determine whether
 or not the resource can be accessed by content operating within the current origin.

 If the server is under your control, add the origin of the requesting site to the set
 of domains permitted access by adding it to the `Access-Control-Allow-Origin`
 header's value.

 For example, to allow a site at `https://example.com` to access the resource using CORS,
 the header should be:


```http
Access-Control-Allow-Origin: https://example.com
```


 You can also configure a site to allow any site to access it by using the
 `*` wildcard. You should only use this for public APIs. Private APIs should
 never use `*`, and should instead have a specific domain or domains set. In
 addition, the wildcard only works for requests made with the
 `crossorigin` attribute set to `anonymous`, and it prevents
 sending credentials like cookies in requests.


```http
Access-Control-Allow-Origin: \*
```


**Warning:** Using the wildcard to allow all sites to access a private
 API is a bad idea.


 To allow any site to make CORS requests *without* using the `*`
 wildcard (for example, to enable credentials), your server must read the value of the
 request's `Origin` header and use that value to set
 `Access-Control-Allow-Origin`, and must also set a `Vary: Origin`
 header to indicate that some headers are being set dynamically depending on the origin.

Examples for common web servers
-------------------------------

The exact directive for setting headers depends on your web server.

In the examples below,

 In **Apache** (docs), add a
 line such as the following to the server's configuration (within the appropriate
 `<Directory>`, `<Location>`,
 `<Files>`, or `<VirtualHost>` section). The
 configuration is typically found in a `.conf` file (`httpd.conf`
 and `apache.conf` are common names for these), or in an
 `.htaccess` file:


```apacheconf
Header set Access-Control-Allow-Origin 'https://example.com'
```


For **Nginx** (docs), the command to set up this header is:


```nginx
add\_header 'Access-Control-Allow-Origin' 'https://example.com' always;
```

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: CORS request did not succeed
====================================

Reason
------
```

Reason: CORS request did not succeed
```

What went wrong?
----------------

 The HTTP request which makes use of CORS failed because the HTTP
 connection failed at either the network or protocol level. The error is not directly
 related to CORS, but is a fundamental network error of some kind.

 In many cases, it is caused by a browser plugin (e.g. an ad blocker or privacy
 protector) blocking the request.

Other possible causes include:

* Trying to access an `https` resource that has an invalid certificate will
 cause this error.
* Trying to access an `http` resource from a page with an
 `https` origin will also cause this error.
* From Firefox 68 to Firefox 84, `https` pages were not permitted to access
 `http://localhost`. This has been changed with Bug 1488740.
* The server did not respond to the actual request (even if it responded to the
 Preflight request). One scenario might be an HTTP service being
 developed that panicked without returning any data.
See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: CORS header 'Origin' cannot be added
============================================

Reason
------
```

Reason: CORS header 'Origin' cannot be added
```

What went wrong?
----------------

 The user agent was unable to add the required `Origin`
 header to the HTTP request. All CORS requests must have an
 `Origin` header.

 This can happen if the JavaScript code is running with enhanced privileges allowing it
 access to multiple domains' content, for example.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Reason: CORS disabled
=====================

Reason
------
```

Reason: CORS disabled
```

What went wrong?
----------------

 A request that needs to use CORS was attempted, but CORS is disabled in
 the user's browser. When this happens, the user needs to turn CORS back on in their
 browser.

 In Firefox, the preference that disables CORS is `content.cors.disable`.
 Setting this to `true` disables CORS, so whenever that's the case, CORS
 requests will always fail with this error.

See also
--------

* CORS errors
* Glossary: CORS
* CORS introduction
Common (exsl)
=============

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

The EXSLT Common package provides basic functions that expand upon the capabilities of XSLT. The namespace for the Common package is `http://exslt.org/common`.

exsl:node-set()`exsl:node-set()` returns a node-set from a result tree fragment, which is what you get when you look at the `xsl:variable` instead of its select attribute to fetch a variable's value. This lets you process the XML created within a variable to process it in multiple steps.

exsl:object-type()`exsl:object-type()` returns a string that indicates the type of the specified object.
Math (math)
===========

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

The EXSLT Math package provides functions for working with numeric values and comparing nodes. The namespace for the Math package is `http://exslt.org/math`.

math:highest()`math:highest()` returns the node in the specified node-set with the highest value (where the highest value calculated using `math:max()`).

math:lowest()`math:lowest()` returns the node in the specified node-set with the lowest value (where the lowest value calculated using `math:min()`).

math:max()`math:max()` returns the maximum value of a node-set.

math:min()`math:min()` returns the minimum value of a node-set.
Strings (str)
=============

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

The EXSLT Strings package provides functions that allow the manipulation of strings. The namespace for the Strings package is `http://exslt.org/strings`.

str:concat()`str:concat()` returns a string containing all the string values in a node-set concatenated together.

str:split()`str:split()` splits a string using a pattern string to determine where the splits should occur, returning a node-set containing the resulting strings.

str:tokenize()`str:tokenize()` splits a string using a set of characters as delimiters that determine where the splits should occur, returning a node-set containing the resulting strings.
Sets (set)
==========

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

The EXSLT Sets package offers functions that let you perform set manipulation. The namespace for these functions is `http://exslt.org/sets`.

set:difference()`set:difference()` returns the difference between two node-sets. In other words, it returns a node-set whose nodes are in one node-set but not in the other.

set:distinct()`set:distinct()` returns a subset of the nodes in the specified node-set, returning only nodes with unique string values.

set:has-same-node()`set:has-same-node()` determines whether two node-sets have any nodes in common.

set:intersection()`set:intersection()` returns the intersection of two node-sets. In other words, it returns a node-set containing all the nodes that exist in both `nodeSet1` and `nodeSet2`.

set:leading()`set:leading()` returns the nodes in one node-set that come before the first node in the other node-set.

set:trailing()`set:trailing()` returns the nodes in one node-set that come after the first node in the other node-set.
Regular expressions (regexp)
============================

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

The EXSLT Regular Expressions package provides functions that allow testing, matching, and replacing text using JavaScript style regular expressions. The namespace for the Regular Expressions package is `http://exslt.org/regular-expressions`.

regexp:match()`regexp:match()` performs regular expression matching on a string, returning the submatches found as a result.

regexp:replace()`regexp:replace()` replaces the portions of a string that match a given regular expression with the contents of another string.

regexp:test()`regexp:test()` tests to see whether a string matches a specified regular expression.
set:distinct()
==============

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

`set:distinct()` returns a subset of the nodes in the specified node-set, returning only nodes with unique string values.

Syntax
------
```

set:distinct(nodeSet)
```

### Parameters

`nodeSet`

The node-set in which to find unique nodes.

### Returns

A node-set containing the nodes that have unique string values.

Specifications
--------------

EXSLT - SET:DISTINCT
set:trailing()
==============

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

`set:trailing()` returns the nodes in one node-set that come after the first node in the other node-set.

Syntax
------
```

set:trailing(nodeSet1, nodeSet2)
```

### Parameters

`nodeSet1`

The node set to find nodes in that follow the first node in the second node set.

`nodeSet2`

The node set to compare against.

### Returns

A node-set containing the nodes from `nodeSet1` whose values follow the first node in `nodeSet2`.

**Note:** If the first node in `nodeSet2` isn't contained in `nodeSet1`, an empty set is returned. If `nodeSet2` is empty, then the result is `nodeSet1`.

Specifications
--------------

EXSLT - SET:TRAILING
set:leading()
=============

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

`set:leading()` returns the nodes in one node-set that come before the first node in the other node-set.

Syntax
------


```js
set:leading(nodeSet1, nodeSet2)
```

### Parameters

`nodeSet1`

The node set to find nodes in that precede the first node in the second node set.

`nodeSet2`

The node set to compare against.

### Returns

A node-set containing the nodes from `nodeSet1` whose values precede the first node in `nodeSet2`.

**Note:** If the first node in `nodeSet2` isn't contained in `nodeSet1`, an empty set is returned. If `nodeSet2` is empty, then the result is `nodeSet1`.

Specifications
--------------

EXSLT - SET:LEADING
set:intersection()
==================

**XSLT/XPath Reference**: XSLT elements, EXSLT functions, XPath functions, XPath axes

`set:intersection()` returns the intersection of two node-sets. In other words, it returns a node-set containing all the nodes that exist in both `nodeSet1` and `nodeSet2`.

Syntax
------
```

set:intersection(nodeSet1, nodeSet2)
```

### Arguments

`nodeSet1`

The first node-set.

`nodeSet2`

The second node-set.

### Returns

A node-set containing the nodes that existed in both `nodeSet1` and in `nodeSet2`.

Specifications
--------------

EXSLT - SET:INTERSECTION