title: Cross-origin redirection denied by Cross-Origin Resource Sharing policy in Safari
body: <p>We have an api endpoint that redirects to another server. It's called via XHR and seems to work fine in most browsers, except for Safari (specifically on iOS).</p>
  
  <p>The error I'm getting in the console is:
  Cross-origin redirection denied by Cross-Origin Resource Sharing policy</p>
  
  <p>We have CORS on the page that does the redirection and on the other server. The redirection page sets:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Allow-Credentials: false
  </code></pre>
  
  <p>The other server has:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  </code></pre>
  
  <p>How can I allow redirection in the CORS policy?</p>