Cross-domain error when calling website API from JavaScript in Chrome extension

Question

I am working on a small Chrome extension that will call the "Remember the Milk API". Google has a good example using the Flickr API, and I use it as the basis for my extension. Their example works fine in my browser (latest Chrome on Linux).

When I replace the names of the Remember Name method and the API API, I get the following error:

XMLHttpRequest cannot load http://api.rememberthemilk.com/services/rest/?method=rtm.test.echo&api_key=xxxxxxxxxxxxxxxxxxxxxx&name=Test%20task. 
Origin chrome-extension://lifnmciajdfhj is not allowed by Access-Control-Allow-Origin.

My code is as follows:

    var req = new XMLHttpRequest();
    req.open(
            "GET",
            "http://api.rememberthemilk.com/services/rest/?" +
            "method=rtm.test.echo&" +
            "api_key=xxxxxxxxxxxxxxxxxxxxxxxxxx&" +
            "name=Test%20task", 
            true);
    req.onload = onResponseReceived;
    req.send(null);

    function onResponseReceived() {
        console.log("It worked.");
    }

Any suggestions?

Answer 1

... , , . manifest.json, API Flikr. , " ", , , , .

Google XHR .

manifest.json. , - .

    {
        "name": "Remember the Milk",
        "version": "1.0",
        "description": "A Remember the Milk extension.",
        "browser_action": {
            "default_icon": "rtm.png",
            "popup": "popup.html"
        },
        "permissions": [
            "http://*.rememberthemilk.com/",
            "https://*.rememberthemilk.com/"
        ]
    }

Answer 2

,

//header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
// or
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Credentials: true");
header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS');
header('Access-Control-Max-Age: 1000');
header('Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description');

, www non-www.