title: ajax POST call to webAPI on different domain
body: <p>I've read many of the "solutions" about 'POST requests on different domain' issue which is also known as 'Cross domain post', and still I cant make that works like they are saying that they fixed it.</p>
  
  <p>From reading all of those articles about this issue I know now why that's happening, but I still need it to work in my project, in the secure way without using hack moves or such things.
  I would like if anyone knows how to make it works, to help us out, I mean 'us' because I believe that still there are people who didn't make it up.</p>
  
  <p>My situation:
  I have webapp which is hosted on domainA, that makes ajax post call to domainB(mvc4 webAPI).
  ajax post call looks like this:</p>
  
  <pre><code>var profile = { Id:"1234567890", Name:"Name_01"}
  $.ajax({
    type: "POST",
    url: 'http://domainB/api/Profile',
    data: JSON.stringify(profile)
  });
  </code></pre>
  
  <p>@domainB I used to set custom response headers:</p>
  
  <pre><code>&lt;system.webServer&gt;
      &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*"/&gt;
          &lt;add name="Access-Control-Allow-Headers" value="X-Requested-With" /&gt;
          &lt;add name="Access-Control-Allow-Methods" value="POST, GET, OPTIONS"/&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>@domainB webAPI post method I have this:</p>
  
  <pre><code>public void Post(dynamic newProfile)
  {
  ...
  }
  </code></pre>
  
  <p>So on activated/started ajax call, in debugging mode at webAPI project I am getting SerializationException <code>Operation could destabilize the runtime</code> at JsonFX.Serilization.DataWriter in the webAPI, and as an error at browser I get</p>
  
  <p><code>XMLHttpRequest cannot load http://domainA/api/Profile. Origin http://domainB is not allowed by Access-Control-Allow-Origin.</code></p>
  
  <p>I am catching the requests and responds on Fiddler and I see that there are no <code>Access-Control-Allow</code> headers at all on the response side.</p>
  
  <p>I wrote what I am using, now because this isn't worked out what should I do to make it happened that ajax post call working from domainA to domainB, or what is the real solution for this.</p>