title: JQuery cross domain basic auth call
body: <p>I have built a REST API backend whith Spring MVC and secured with basic Auth with Spring Security.</p>
  
  <p>I would like to do cross domain ajax call to the REST API from Javascript clients. I don't want to use JSONP because i don't want to be limited to GET calls. I use CORS and i have put the right headers on server side.</p>
  
  <p>Suppose my REST API is on domain localhost:8087 and my client on localhost:8086, which is cross domain call.</p>
  
  <p>In my Javascript client, i make ajax call with jQuery :</p>
  
  <pre><code>&lt;script&gt;
          $.ajax ({
              url: "http://localhost:8087/SpringMVC/users/user1",
              beforeSend: function (xhr) { xhr.setRequestHeader ("Authorization", "Basic xxxxxxxxxxxx"); },
              success: function(val) { console.log(val); alert("success" + val); },
              error: function(val) { console.log(val); alert("error" + val); }
          });
  &lt;/script&gt;
  </code></pre>
  
  <p>My problem is that jQuery does not send the Authorization header in the HTTP request and i don't know why. I don't understand because i do it in the beforeSend method, so it should be inside the HTTP request. Result : i have a 401 error.</p>
  
  <p>When i try the script from the same domain localhost:8087, which is not cross domain anymore, i have no problem.</p>
  
  <p>How is it possible ?</p>
  
  <p>My script is just a test. I don't intend to put my username/password on client side. But i want to test how to do ajax calls to a basic auth protected REST API. I imagine i have to send on server side to be secure my username/password, the REST API sends me back a cookie and i don't need to pass the username/password anymore for my next ajax calls to the REST API. Am i right ?</p>
  
  <p>I have tested my REST API with Chrome Advanced REST client and it is working like that. For the first request i need to pass the authorization header. Then it is not needed. Should it work also like that with my javascript web client ? I intend to use Node.JS with Backbone to build it.</p>
  
  <p>Thanks a lot.</p>
  
  <p><strong>EDIT2</strong> : Seems really to be a CORS Browser problem. I have added the header Access-Control-Allow-Methods for OPTIONS method on server side and it works on Chrome. I have access to the JSON response with no error anymore. But i still need to use the authorization header for the next requests. How to tell jQuery to use the cookie sent ?</p>
  
  <p>And when i try with Firefox 11, i have no access to the json response and i have the error :</p>
  
  <pre><code>"NetworkError: 401 Non-Autorisé - http://localhost:8087/SpringMVC/users/user1"
  </code></pre>