没有“ Access-Control-Allow-Origin”标头和未授权的错误

Question

我正在尝试使用javascript中的xmlhttp连接使用Elastic Search构建的Restful API。但是，当我发出请求时，出现以下错误：

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://192.168.56.1:8080' is therefore not allowed access.

这是第二个错误；

OPTIONS http://serveripaddress//elasticsearch/users/user/_search 401 (Unauthorized)

我在elasticseach.yml中添加了这些权限

http.cors.enabled: "true"
http.cors.allow-origin: "/.*/"
http.cors.allow-credentials: "true"
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, Authorization"

以下代码发出了请求：

var xhr = new XMLHttpRequest();
 xhr.open('POST', 'http://serveripaddress/_search', true);
xhr.withCredentials = true;
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.setRequestHeader('Authorization', 'Basic ' + btoa('test:test'));
xhr.send('{"query":{"match_all":{}}}');

我还想精确地说，Elasticsearch是托管在Google云VM中，并且我正在本地主机http://192.168.56.1:8080上测试我的项目。