The problem you're having is solved with CORS:
The Cross-Origin Resource Sharing standard works by adding new HTTP
headers that allow servers to describe the set of origins that are
permitted to read that information using a web browser. Additionally,
for HTTP request methods that can cause side-effects on user data (in
particular, for HTTP methods other than GET, or for POST usage with
certain MIME types), the specification mandates that browsers
"preflight" the request, soliciting supported methods from the server
with an HTTP OPTIONS request method, and then, upon "approval" from
the server, sending the actual request with the actual HTTP request
method. Servers can also notify clients whether "credentials"
(including Cookies and HTTP Authentication data) should be sent with
You need to add headers, from the server, to the response telling the browser that made the request that you'll trust other origin domains. That link reviews the process and the required headers. You add headers such as:
Access-Control-Allow-Methods "GET, POST, PUT, OPTIONS, DELETE";
The first header tells the browser to allow cross server requests from your site's JS code. There are security concerns with this approach, which is why this is not allowed directly in the first place.