[Solved] HTML5 tour hosted in a different domain, enable CORS, check headers, etc...

Help!

I've been trying during the last 2 hours to understand the HTML5 Cross-Origin thing, and now my brain hurts. Literally!

So this is my problem:
- There is a virtual tour hosted in my clients server: http://www.creare360.co.uk/virtual-tours/…ets/scene1.html
- My client wants to embed that virtual tour in one of its clients website: http://www.chadwickscarpets.co.uk/
- Flash works, but the iPad version doesn't. It display this message:
"FATAL ERROR: http://www.creare360.co.uk/virtual-tours/…/files/tour.xml - Loading failed! (0)"
- I understand that this error is because of the virtual tour is being requested from another domain outside of the domain the resource originated from.
- I also understand that a way to fix this is enabling CORS: http://www.html5rocks.com/en/tutorials/cors/

But I'm failing miserably is understand how to do this with Krpano.
I can't ask my client to enable CORS in his server, so the only option is enable CORS on the Client.

There some information in the excelent Krpano documentation, but I don't understand several things:

1- Where do I have to add the following code:

<security cors="">
    <crossdomainxml url="http://.../crossdomain.xml" />
    <crossdomainxml url="..." />
    ...
    <allowdomain domain="www.other-domain.com" />
    <allowdomain domain="..." />
    ...
</security>

Inside http://www.creare360.co.uk/virtual-tours/…/files/tour.xml?

2- In my example, I think that piece of code should look like this:

<security cors="anonymous">
    <crossdomainxml url="http://www.creare360.co.uk/virtual-tours/crossdomain.xml" />
</security>

Is that right?

I've read in several Forum threads that I need to "check the headers are sent correctly from the server". What does it means?
I'm using Firefox + Live HTTP Headers Add-on. But there is too much information and I'm not sure what am I looking for.
Any way, is that relevant for my example? The tour images path are relative to %SWFPATH%

Please, any help will be highly appreciated!!!

Can anyone please help me or at least point me to the right direction?

Thanks

Thank you very much Klaus.

I'll contact to the client and ask if he's willing to change their server settings.

Cheers

I've just found the following page to test if CORS are enabled

http://test-cors.org

I've tested my client's server, which is where the virtual tours are hosted.
It returns nothing, which means CORS aren't enabled.

On the other hand, https://krpano.com is OK

Is this correct?

Thanks!

Wicked!

This is exactly what I needed!

Thank you very much!