title: Internet Explorer 10 is ignoring XMLHttpRequest 'xhr.withCredentials = true'
body: <p>I’m currently having an issue with a cross-domain ajax call using IE10 (in IE10 mode, not compatibility).</p>
  
  <p>Situation:
  I have two domains, <code>http://a</code> and <code>http://b</code>. I have a cookie set for <code>http://b</code>. I am currently on page <code>http://a</code>.</p>
  
  <p>I want to do a CORS request to <code>http://b</code> using XMLHttpRequest (which should work, according to <a href="http://blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx" rel="noreferrer">http://blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx</a>), and include the cookie in the request.
  The JS is as follows:</p>
  
  <pre><code>var xhr = new XMLHttpRequest();
  xhr.open('GET', 'http://b', true);
  xhr.withCredentials = true;
  xhr.send();
  </code></pre>
  
  <p>This should ensure that the cookie is attached to the request; however, the Fiddler trace shows that no cookie is attached, and I get <code>401: Access Denied</code>.</p>
  
  <p>The server is configured to work with CORS, it includes the Access-Control headers:</p>
  
  <pre><code>Access-Control-Allow-Origin: http://a
  Access-Control-Allow-Credentials: true
  </code></pre>
  
  <p>(this should not make any difference, since there is no OPTIONS preflight request, and the first request IE sends is a GET, and the cookie is not present, thus causing a 401).</p>
  
  <p>Furthermore, the JS snippet works fine in both Firefox and Opera.</p>