title: CORS in App Engine application (python)
body: <p>I'm trying to do x-domain request between 2 applications in app engine. In one hand, i have my API and in the other hand i have my "client application". I have been reading so much about CORS; i think i know how it works, and here comes the problem: It doesn't work. Simple request works, but the problem comes when i try to do non-simple request (with credentials). I have this code to handle the headers and allow CORS:</p>
  
  <pre><code>try:
      _origin = self.request.headers['Origin']
  except:
      _origin = "http://myapp"
  self.response.headers.add_header("Access-Control-Allow-Origin", _origin)
  self.response.headers.add_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
  self.response.headers.add_header("Access-Control-Allow-Credentials", "true")
  self.response.headers.add_header("Access-Control-Allow-Headers", "origin, x-requested-with, content-type, accept")
  self.response.headers.add_header('Content-Type', 'application/json')
  self.response.out.write( json.dumps( _response ) )
  </code></pre>
  
  <p>EDITED: I'm working with both applications under the same domain (http://app1.domain.com and <a href="http://app2.domain.com" rel="nofollow">http://app2.domain.com</a>). </p>
  
  <p>As i cannot use wildcards for request with credentials transference, i detect the Origin and i set the Allow-Origin in each request for this domain. In my client app i have this code to make the http requests:</p>
  
  <pre><code>jQuery.extend( {
  postJSON: function ( _url, _data, _callback) {
      $.ajax({
          cache: false,
          crossDomain: true,
          url: _url,
          data: _data,
          type: 'POST',
          dataType: 'json',
          xhrFields: {
             withCredentials: true
          },
          headers : {
              "x-requested-with" : "XMLHttpRequest"
          },
          success: _callback,
          error: function() {
              _msg = "&lt;strong&gt;Error: &lt;/strong&gt; Error en la petición HTTP (nivel de protocolo).";
              _error( _msg );
          }
      });
  }
  </code></pre>
  
  <p>});</p>
  
  <p>In order to handle the request, i have these methods:</p>
  
  <pre><code>@decorators.notAllowed
  def get(self):
      pass
  
  @decorators.isNotLogged
  @decorators.language
  def post(self):
      common._responseJSON( self, CU._doLogin( self ) )
  
  def options(self):
      common._responseJSON( self, CU._doLogin( self ) )
  </code></pre>
  
  <p>This is the OPTIONS request and response:</p>
  
  <pre><code>Request URL:http://myapi/method
  Request Method:OPTIONS
  Status Code:200 OK
  
  Request Headers
  Accept:*/*
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:es-ES,es;q=0.8
  Access-Control-Request-Headers:origin, x-requested-with, content-type, accept
  Access-Control-Request-Method:POST
  Connection:keep-alive
  Host:myapi
  Origin:http://myapp
  Referer:http://myapp/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
  
  Response Headersview source
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:origin, x-requested-with, content-type, accept
  Access-Control-Allow-Methods:GET, POST, OPTIONS
  Access-Control-Allow-Origin:http://myapp
  Cache-Control:no-cache
  Content-Encoding:gzip
  Content-Length:114
  Content-Type:application/json
  Content-Type:text/html; charset=utf-8
  Date:Fri, 16 Nov 2012 11:31:40 GMT
  Server:Google Frontend
  Vary:Accept-Encoding
  </code></pre>
  
  <p>And this is the HTTP POST request:</p>
  
  <pre><code>    Accept:application/json, text/javascript, */*; q=0.01
  Content-Type:application/json; charset=UTF-8
  Origin:http://myapp
  Referer:http://myapp
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
  x-requested-with:XMLHttpRequest
  </code></pre>
  
  <p>But when the browser tries to do the POST request, it fails:</p>
  
  <pre><code>XMLHttpRequest cannot load http://myapi/method/. Origin http://myapp is not allowed by Access-Control-Allow-Origin.
  </code></pre>
  
  <p>Any idea? I'm getting insane with this problem... What i have to do in the OPTIONS http request? Maybe i'm not handling it in right way... :-/ </p>
  
  <p>Thanks in advance.</p>