So there are now settings to add domains to the CORS whitelist so they can access the REST API via javascript. I tried to get this to work using my localhost with an a local ssl so its https://coach.dev:8443
But im still getting this error:
XMLHttpRequest cannot load https://test.salesforce.com/services/oauth2/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://coach.dev:8443' is therefore not allowed access.
Any ideas what I might be missing?
UPDATE:
Also important to note if i request the token via the proxy, and then remove the proxy from all the other requests it does seem to respect the CORS settings and let me do queries without a proxy.
Is is just that the token request wont use the CORS?