@dcooney oh, yes.
In my case, the ajax request is being sent to a subdomain (because of a reverse proxy) which triggers the CORS error.
Thank you @dcooney for following up on this.
I think it’s the default behavior for XMLHttpRequest to follow the same-origin policy. Also, browsers restrict cross-origin requests by default.