title: AngularJS withCredentials Not Sending
body: <p>In AngularJS, I have my Restful API in a subdomain but I am having the problem where the cookie/session is not being shared across domains. For Angular I am doing this:</p>
  
  <pre><code>app.config(['$httpProvider',
  function($httpProvider) {
      $httpProvider.defaults.useXDomain = true;
      $httpProvider.defaults.withCredentials = true;
      delete $httpProvider.defaults.headers.common['X-Requested-With'];
  }]);
  </code></pre>
  
  <p>Also when I am making a request with $http I am doing</p>
  
  <pre><code>var object = {};
  
  object.url = '/example'
  object.withCredentials = true;
  
  $http(object).success(object.success).error(object.error);
  </code></pre>
  
  <p>And On my server side I have:</p>
  
  <pre><code>if($_SERVER['REQUEST_METHOD']=='OPTIONS') {
      if(isset($_SERVER['HTTP_X_FOWARDED_HOST']) &amp;&amp; !empty($_SERVER['HTTP_X_FOWARDED_HOST'])) {
          $origin=$_SERVER['HTTP_X_FOWARDED_HOST'];
      } else {
          $origin=$_SERVER['HTTP_ORIGIN'];
      }
      if(isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) &amp;&amp; ($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']=='POST' || $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']=='DELETE' || $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']=='PUT')) {
          header('Access-Control-Allow-Origin: '.$origin);
          header('Access-Control-Allow-Credentials: true');
          header('Access-Control-Allow-Headers:  *,X-Requested-With,Content-Type');
          //header('Access-Control-Allow-Headers: Content-Type');
          header('Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT');
          // http://stackoverflow.com/a/7605119/578667
          header('Access-Control-Max-Age: 86400');
      }
  
  }
  </code></pre>
  
  <p>Now I see that the server is saying that it will allow credentials but its not being sent in the options request. Screenshot below. </p>
  
  <p><img src="https://i.stack.imgur.com/qpzEQ.png" alt="enter image description here">
  What am I doing wrong?</p>