function createCORSRequest(method, url) {
            var username ='usuario';
            var password ='contraseña';
            var xhr = new XMLHttpRequest();
            xhr.setRequestHeader("Content-type", "text/xml");
            xhr.setRequestHeader("Authorization", "Basic " + btoa(username + ":" + password));
            xhr.setRequestHeader("Ocp-Apim-Subscription-Key", 'api key');
          if ("withCredentials" in xhr) {
            xhr.open(method, url, true);
          } else if (typeof XDomainRequest != "undefined") {
            xhr = new XDomainRequest();
            xhr.open(method, url);
          } else {
            xhr = null;
          }
          return xhr;
        }
        function getTitle(text) {
          return text.match('<title>(.*)?</title>')[1];
        }
        function makeCorsRequest() {
            var url = "url";
            var method ="POST";
            var xhr = createCORSRequest(method, url);
              if (!xhr) {
            alert('CORS not supported');
            return;
          }
         var params = `xml a enviar`;
         xhr.onload = function() {
            var text = xhr.responseText;
            var title = getTitle(text);
            alert('Response from CORS request to ' + url + ': ' + title);
          };
          xhr.onerror = function() {
            alert('Woops, there was an error making the request.');
          };
          xhr.send(params);
        }
         makeCorsRequest();