title: Safari issue with CORS: Origin is not allowed by Access-Control-Allow-Origin
body: <p>We have a Node.js based application on one of our servers (lets call it 'my.apiserver.com').  Our client has web site in a different domain (my.client.com). When a user goes to our client's website there are a series of html pages received from, and ajax-based requests sent to, our server. This seems to work fine across all devices and browsers with the exception of the latest Safari version (8). For the majority (but oddly not all) of the Safari-8 users they receive error messages along these lines: </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://my.apiserver.com/views/view1.html" rel="noreferrer">http://my.apiserver.com/views/view1.html</a>.
    Origin <a href="http://my.client.com" rel="noreferrer">http://my.client.com</a> is not allowed by
    Access-Control-Allow-Origin</p>
  </blockquote>
  
  <p>and </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="http://my.apiserver.com/ajax_endpoint1?id=12345" rel="noreferrer">http://my.apiserver.com/ajax_endpoint1?id=12345</a>. Origin
    <a href="http://my.client.com" rel="noreferrer">http://my.client.com</a> is not allowed by Access-Control-Allow-Origin</p>
  </blockquote>
  
  <p>Inside of our app.js file the node application has it's cross-domain security setup like so:</p>
  
  <pre><code>/***************************************************************************/
  /* configure CORS
  /***************************************************************************/
  app.use(function(req, res, next) {
    res.set('Access-Control-Allow-Origin', 'http://my.client.com');
    res.set('Access-Control-Allow-Credentials', true);
    res.set('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
    res.set('Access-Control-Allow-Headers', 'Origin, Product-Session, X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, Referer, User-Agent');
  
    // intercept OPTIONS method
    if ('OPTIONS' == req.method) {
      res.send(200);
    }
    else {
      next();
    }
  });
  </code></pre>
  
  <p>Any insights as to why our cors setup is failing for the latest Safari would be appreciated.</p>
  
  <p>Thanks</p>