title: Differences with cookies between getJSON and ajax when doing CORS
body: <p>I have a REST based web service running in my Tomcat Java EE servlet container.</p>
  
  <p>I am writing a jquery client that is from another domain and is therefore using CORS. It hits the login web service, followed by another call. I originally implemented these two calls using getJSON and the calls were working fine, but I wasn't getting the JSESSIONID cookie to stay on the second call, so the web service had an unauthenticated session and threw and error.</p>
  
  <p>After doing research, I ran across doing ajax withCredentials and thought that this is what I needed to do. The AJAX login call failed in preflight.</p>
  
  <p>So, when I sniff the traffic to my webserver, the getJSON calls run as two gets and look fine except that the cookie doesn't come back with the second call. When I run the ajax call, it does an OPTIONS call to my server, gets a 200 status back on the client and then fails inside of jQuery for reasons I can't seem to find.</p>
  
  <pre><code>var jqxhr = jQuery.getJSON(loginUrl, {
    xhrFields: {
        withCredentials: true
    },
    crossDomain: true
  })
  .done(function(response) {
      AgileJurySessionKey = response;
      AgileJuryLoggedIn = true;
      doneCallback();
  })
  .fail(function() {
      failCallback();
  });
  </code></pre>
  
  <p>Here is the AJAX version of the same call:</p>
  
  <pre><code>jQuery.ajax(loginUrl, {
      type: "GET",
      contentType: "application/json; charset=utf-8",
      success: function(data, status, xhr) {
          alert(data);
          doneCallback;
      },
      error: function(jqxhr, textStatus, errorThrown) {
          alert(errorThrown);
          failCallback;
      },
      xhrFields: {
          withCredentials: true
      },
      crossDomain: true
  });
  </code></pre>
  
  <p>What's different between these two?</p>
  
  <p>Here's the filter I put in to the web server for CORS:</p>
  
  <pre><code>/**
   * This filter allows access to our web services from clients that are not on the local domain
   * 
   * @author Xerox
   */
  public class CorsFilter extends OncePerRequestFilter {
  
    /* (non-Javadoc)
     * @see org.springframework.web.filter.OncePerRequestFilter#doFilterInternal(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, javax.servlet.FilterChain)
     */
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        response.addHeader("Access-Control-Allow-Origin", "*");
        if (request.getHeader("Access-Control-Request-Method") != null &amp;&amp; "OPTIONS".equals(request.getMethod())) {
            // CORS "pre-flight" request
            response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
            response.addHeader("Access-Control-Allow-Headers", "X-Requested-With,Origin,Content-Type,Accept,Set-Cookie");
            response.addHeader("Access-Control-Max-Age", "1800");//30 min
        }
        filterChain.doFilter(request, response);
    }
  }
  </code></pre>