title: CORS request with IE11
body: <p>I have a CORS (cross origin resource sharing) request coming from my login page to the application site, on a different URL. I have a simple page I ping to determine if a user is already logged in, and if so, redirects them. Otherwise I show a login page. I use jQuery.</p>
  
  <p>This works great in safari, chrome, firefox... and not IE (naturally). According to MS, IE 10 and later should support <a href="http://msdn.microsoft.com/en-us/library/ie/hh673569%28v=vs.85%29.aspx">CORS requests with withCredentials</a></p>
  
  <p>I'm using jquery-2.0.3.min.js</p>
  
  <p>Any ideas why this isn't working in IE11?</p>
  
  <p>EDIT: It appears as though it IS partially working, as it is now returning a value of {"id":false}. This happens every time, meaning that the server is never getting the credentials. I am also posting my is_logged_in page, I am using the code igniter framework.</p>
  
  <p>EDIT: After enabling "Allow data sources across domains" under IE's security settings, I no longer receive any error messages.</p>
  
  <p><del>The exact error I receive is:</del></p>
  
  <blockquote>
    <p><del>SEC7118: XMLHttpRequest for <a href="http://mysite.net/guest/is_logged_in">http://mysite.net/guest/is_logged_in</a> required Cross Origin Resource Sharing (CORS).</del></p>
  </blockquote>
  
  <pre><code>$.ajax({
  url: 'http://mysite.net/guest/is_logged_in',
  type: 'POST',
  crossDomain: true,
  xhrFields: {
         withCredentials: true
    },
  
  dataType: 'json',
  success: function(data) {
  
      if(data.id) {
          window.location.replace("http://mysite.net");
      }
  }
  });
  </code></pre>
  
  <p>and</p>
  
  <pre><code>public function is_logged_in()
  {
      $allowed = array(
          'http://mysite.net',
          'http://www.mysite.net',
          'http://www.mysite.com',
      );
  
      $url = $_SERVER['HTTP_REFERER'];
      $url = substr($url, 0, strpos($url, '/', 8));
      if(isset($_SERVER['HTTP_ORIGIN']))
      {
          if(in_array($_SERVER['HTTP_ORIGIN'], $allowed))
          {
              $this-&gt;output-&gt;set_header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
          }
      }
      else
      {
          if(in_array($url, $allowed))
          {
              $this-&gt;output-&gt;set_header('Access-Control-Allow-Origin: ' . $url);
          }
      }
  
  
      $this-&gt;output-&gt;set_header('Access-Control-Allow-Headers: X-Requested-With');
      $this-&gt;output-&gt;set_header('Access-Control-Allow-Credentials: true');
      $this-&gt;output-&gt;set_header("Access-Control-Expose-Headers: Access-Control-Allow-Origin");
  
  
      //TODO: Try to detect if this is an ajax request, and disallow it if not.
  
      $data = new stdClass();
      $this-&gt;load-&gt;library("ion_auth");
      if($this-&gt;ion_auth-&gt;logged_in())
      {
          $data-&gt;name = $this-&gt;ion_auth-&gt;user()-&gt;row()-&gt;first_name;
          $data-&gt;id = $this-&gt;ion_auth-&gt;get_user_id();
      } else {
          $data-&gt;id = false;
      }
  
      $this-&gt;output-&gt;set_output(json_encode($data));
  
  }
  </code></pre>
  
  <p>Thanks in advance</p>