title: Making CORS request using Backbone in IE8/9
body: <p>I'm writing a backbone app that's going to live on app.ourdomain.com/store. </p>
  
  <p>I'd like to access data on api.ourdomain.com/ourApi, using HTTP Authentication already built in to our API.</p>
  
  <p>Now, as I understand it, a CORS header, <code>Access-Control-Allow-Origin: *</code>, is required in the response to allow this cross-origin support. </p>
  
  <p>However, this does not work in IE8/9. I've read on SO &amp; elsewhere that I can simply add <code>$.support.cors = true;</code> and this will magically start working on IE8/9.</p>
  
  <p>Before I get too deep into this project, I'm hoping somebody with practical experience can answer this: </p>
  
  <p>If we code up our API to handle the pre-flight OPTIONS request, allowing the cross-origin request, add this overrride to the <code>$.support</code> object, will we then get full access to all HTTP verbs (including PUT/DELETE), the ability to authenticate, and include custom headers in IE8/9 (like we do in all modern browsers using the XMLHttpRequest)? </p>
  
  <p><a href="http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx" rel="nofollow">This article</a> describes the restrictions/limitations of the <code>XDomainRequest</code> object that IE8/9 uses for these kinds of requests. I'm concerned specifically with #3 &amp; #5 which state: </p>
  
  <pre><code>#3: No custom headers may be added to the request
  </code></pre>
  
  <p>We use a custom header to indicate the CustomerID that's making the request</p>
  
  <pre><code>#5: No authentication or cookies will be sent with the request
  </code></pre>
  
  <p>We use HTTP Authentication to authenticate the user on the initial request, and on subsequent requests use an access_token returned during the original request.</p>
  
  <p>Since IE8/9 support is mandated right now, does that mean I can't use Backbone to request data to a different subdomain on our system, without doing something silly like create a proxy API on subdomainA to access data on subdomainB?</p>
  
  <p>Cheers.</p>