title: XMLHttpRequest across Domains to read COOKIE
body: <p>Dear all i have a strange problem .</p>
  
  <p>My target is :
     Site <strong>abc.com</strong> will send ajax '<strong>POST/GET</strong>' request to site <strong>xyz.com</strong></p>
  
  <p><strong>xyz.com</strong> will create a  <strong>COOKIE</strong> via PHP and print it out : </p>
  
  <pre><code>print $_COOKIE["rand_user_id"];
  </code></pre>
  
  <p>so the site <strong>abc.com</strong> will read the printed TEXT via "<strong>xhr.responseText</strong>".</p>
  
  <p>PS: even if Page has been refreshed , the xhr.responseText will print same TEXT.</p>
  
  <p><strong>Problem :</strong> All the provisos description is works just fine</p>
  
  <p><strong>But JavaScript want able to print out the Content TEXT !</strong></p>
  
  <p>and the <strong>xhr.status</strong> return 0 !!!!</p>
  
  <p>when i sniff the response via HTTPAnalyze i can see the TEXT in the content of the responseText. and the response code is 200 in the HTTPAnalyze program.</p>
  
  <p>Please advice</p>
  
  <hr>
  
  <p>My code is :</p>
  
  <h2><strong>Client side</strong></h2>
  
  <pre><code>    &lt;script&gt;
  window.onload = function(){
      var xhr = new XMLHttpRequest();
      xhr.open("GET", "http://www.adriper.com/setcookie.php", true);
      xhr.onreadystatechange = function(){
          if ( xhr.readyState == 4 ) {
              if ( xhr.status == 200 ) {
                  document.body.innerHTML = "Random code  is: " + xhr.responseText;
              } else {
                  document.body.innerHTML = "ERROR Number :"+xhr.status;
              }
          }
      };
  
      xhr.withCredentials = true; 
      xhr.send(null);
  };
  &lt;/script&gt;
  </code></pre>
  
  <h2><strong>Server side is :</strong></h2>
  
  <p><strong>PHP</strong></p>
  
  <pre><code>&lt;?
  if(!isset($_COOKIE["rand_user_id"]))
  {
     $val = md5(rand(111,999));   
     setcookie("rand_user_id", $val , time()+60*60*24*30, '/');
     print $_COOKIE["rand_user_id"];
  }else{
      print $_COOKIE["rand_user_id"];
      }
  ?&gt;
  </code></pre>
  
  <p><strong>.htaccess</strong></p>
  
  <pre><code>Header add Access-Control-Allow-Origin "*"
  Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type ,accept"
  Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"
  Header add Access-Control-Allow-Credentials: true
  </code></pre>
  
  <p><strong>HTTP Response</strong> </p>
  
  <pre><code>GET /setcookie.php HTTP/1.1
  Host: www.adriper.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: http://localhost/mouse/Untitled-1.html?w
  Origin: http://localhost
  Cookie: rand_user_id=m3zwy_pomRVe1FovfsOXBLJvUyw_lnA6MWMjot1lSGtXB3MwGXJlR0d2afbxwBWe
  Connection: keep-alive
  </code></pre>
  
  <p><strong>Options</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: nginx
  Date: Tue, 22 Jan 2013 00:55:30 GMT
  Content-Type: text/html
  Connection: keep-alive
  X-Powered-By: PHP/5.2.17
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Headers: origin, x-requested-with, content-type ,accept
  Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS
  Access-Control-Allow-Credentials: true
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Content-Length: 52
  </code></pre>