title: CORS request failure with jQuery using withCredentials and client certificates
body: <p>I can't figure out why this CORS request is failing to return data.</p>
  
  <p>I'm using Catalyst MVC on the backend, Firefox 24.0 as a browser. jQuery 1.9.1. Please note the following:</p>
  
  <ol>
  <li>otherdomain.com requires a client certificate.</li>
  <li>hitting the resource directly returns expected data. (<a href="https://otherdomain.com/resource/1" rel="noreferrer">https://otherdomain.com/resource/1</a>) returns proper data.</li>
  </ol>
  
  <p>I have a simple page that tests the request:</p>
  
  <pre><code>&lt;script type='text/javascript'&gt;
                  function get_data() {
                          console.log("running");
                          $.ajax({
                                  url: "https://otherdomain.com/resource/1",
                                  dataType: 'json',
                                  type: 'GET',
                                  xhrFields: {
                                          'withCredentials': true
                                  },
                                  crossDomain: true
                          }).success(function(data) {
                                  console.log(data)
                                  $('#output').html(data);
                          }).error(function(xhr, status, error) {
                                  alert("error");
                                  console.log(xhr);
                          });
                  }
  
      $(document).ready(function() {
              get_data();
      });
      &lt;/script&gt;
  
  &lt;/script&gt;
  </code></pre>
  
  <p>Here are my request headers:</p>
  
  <pre><code>GET /resource/1 HTTP/1.1
  Host: otherdomain.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  DNT: 1
  Referer: https://mydomain.com/test.html
  Origin: https://mydomain.com
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  </code></pre>
  
  <p>Here are my response headers. (copy of view source from firebug console) I see on  my catalyst debug output that the request is served as 200 OK and the content is sent. </p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Mon, 28 Oct 2013 19:31:08 GMT
  Server: HTTP::Server::PSGI
  Vary: Content-Type
  Content-Length: 653
  Content-Type: application/json
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Methods: POST, GET, OPTIONS
  Access-Control-Allow-Origin: *
  Access-Control-Max-Age: 1800
  X-Catalyst: 5.90030
  Via: 1.1 otherdomain.com
  </code></pre>
  
  <p>And the error is thrown from the ajax call:</p>
  
  <pre><code>readyState: 0
  responseText: ""
  status: 0
  statusText: "error"
  </code></pre>
  
  <p>firebug shows the response body as empty from the request event though it's a 200 OK.</p>
  
  <p>I thought that when using 'withCredentials' a pre-flight request was required but I don't see an OPTIONS being sent via firebug.</p>
  
  <p>Also, i can see no <code>Access-Control-Request-Header</code> being added by my request, so I'm not returning any <code>Access-Control-Allow-Headers</code> from the server.</p>
  
  <p>Now, the frontend of Catalyst is Apache2, and I'm using proxypass in a virtual host to send the request to catalyst on localhost:8080. I'm not sure if that has any bearing but thought it might be important. It should be transparent to the browser though.</p>
  
  <p>Thanks for any help!</p>