title: Cross Origin requests are disallowed on Safari when Basic authentication is enabled
body: <p>I've encountered this problem which only seems to affect Safari (11.1). The same code runs fine on Firefox and Chrome.
  I was experimenting with making cross domain Ajax requests when basic HTTP authentication is enabled (on both sites). Https is also enabled. I'm using Apache 2.4.29 on a Macbook Pro.</p>
  
  <p>The set up is that I have two test sites running on my local machine,  foo.com and bar.com. foo.com makes an Ajax request for a json file that resides on bar.com. As stated, all communication takes place over https which I set up with a self-signed certificate.</p>
  
  <p>Here is my Apache configuration</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
    ServerName foo.com
    DocumentRoot "/Users/richardhunter/development/cors-experiment/foo"
    ErrorLog "/private/var/log/apache2/foo-error-log"
    CustomLog "/private/var/log/apache2/foo-access-log" common
    SSLEngine on
    SSLCertificateFile "/Users/richardhunter/development/cors-experiment/certificates/foo/foo.crt"
    SSLCertificateKeyFile "/Users/richardhunter/development/cors-experiment/certificates/foo/foo.key"
    &lt;Directory "/Users/richardhunter/development/cors-experiment/foo"&gt;
      AuthType Basic                            
      AuthName "Restricted Files"               
      AuthBasicProvider file                    
      AuthUserFile "/Users/richardhunter/development/cors-passwords"
      Require user richard  
    &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  
  &lt;VirtualHost *:443&gt;
    ServerName bar.com
    DocumentRoot "/Users/richardhunter/development/cors-experiment/bar"
    ErrorLog "/private/var/log/apache2/bar-error-log"
    CustomLog "/private/var/log/apache2/bar-access-log" common
    SSLEngine on
    SSLCertificateFile "/Users/richardhunter/development/cors-experiment/certificates/bar/bar.crt"
    SSLCertificateKeyFile "/Users/richardhunter/development/cors-experiment/certificates/bar/bar.key"
    Header set Access-Control-Allow-Origin "https://foo.com"
    Header set Access-Control-Allow-Credentials true
  
    &lt;Directory "/Users/richardhunter/development/cors-experiment/bar"&gt;
      AuthType Basic    
      AuthName "Restricted Files"    
      AuthBasicProvider file    
      AuthUserFile "/Users/richardhunter/development/cors-passwords"
      Require user richard  
    &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  
  </code></pre>
  
  <p>On Safari I get this error in the console: </p>
  
  <pre><code>TypeError: Origin https://foo.com is not allowed by Access-Control-Allow-Origin.
  (anonymous function)
  </code></pre>
  
  <p>If I turn off authentication on the server, then the call works. There wasn't anything more useful in the error logs. </p>
  
  <p>I hope that cross-domain calls of this type are possible on Safari on a live site (not using self-signed certificates), but I don't know that to be the case. Obviously, I'd be interested to know. I would also like my local environment to replicate a live one as closely as possible.</p>
  
  <p>My code is in <a href="https://github.com/Richardinho/cors-with-authentication" rel="nofollow noreferrer">this Github repo</a></p>