title: WebApi and MVC in different projects, share cookies?
body: <p>I've separated my WebApi project into a MVC project (<a href="http://mydomain.com" rel="nofollow noreferrer">http://mydomain.com</a>) and a  WebApi project (<a href="http://api.mydomain.com" rel="nofollow noreferrer">http://api.mydomain.com</a>).</p>
  <p>My MVC project just manages authentication and service up the views (which use knockoutJS and ajax).</p>
  <p>My problem is that the cookies from the MVC project is not sent when requesting information from the webapi domain (<em><strong>using ajax</strong></em>). Or rather, during testing I'm using two IIS Express servers on different parts.</p>
  <p>The project is going to be deployed do Azure later, so any solution must work between two web sites.</p>
  <p>So how can I get those cookies to be sent through? Or should I switch to use some kind of token instead?</p>
  <h1>Edit</h1>
  <p>It works until I add <code>contentType</code> to the <code>$.ajax</code> request. I get the CORS preflight OPTION then. I answer it 200 with what I think is the correct headers. If I remove that option I get a working request with all cookies again.</p>
  <p><strong>Works</strong></p>
  <pre><code>$.ajax({
      url: &quot;http://localhost:54304/Organization/&quot;,
      type: &quot;POST&quot;,
      data: &quot;$top=10&quot;,
      xhrFields: {
          withCredentials: true
      },
      crossDomain: true,
      success: function (data) { console.log(data); }
  });
  </code></pre>
  <p>Do not work:</p>
  <pre><code>$.ajax({
      url: &quot;http://localhost:54304/Organization/&quot;,
      contentType: 'application/json', //&lt;--- this triggers preflight
      type: &quot;POST&quot;,
      data: &quot;$top=10&quot;,
      xhrFields: {
          withCredentials: true
      },
      crossDomain: true,
      success: function (data) { console.log(data); }
  });
  </code></pre>
  <p>Now is that a jquery &quot;feature&quot; or is it how CORS works? What headers should I set? I've tried to reply with:</p>
  <pre><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Origin:http://localhost:51343
  </code></pre>