 <p>Based on what I found out here: <a href="http://stackoverflow.com/questions/14945861/sending-correct-json-content-type-for-cakephp">Sending correct JSON content type for CakePHP</a></p> <p>The correct way to return JSON in CakePHP is like so:</p> <pre><code>$this-&gt;response-&gt;type('json'); $this-&gt;response-&gt;body(json_encode(array('message'=&gt;'Hello world!'))); </code></pre> <p>This is because the headers can be overridden and therefore the CORS doesn't work unless you do it the 'proper' way using the response object in Cake.</p>