title: Why does this cross-domain request work in other browsers but not IE9?
body: <p>I have some Ajax code that is working in Safari, Chrome and Firefox but not in IE9.  </p>
  
  <p>The page is on <code>http://foo.com/test.aspx</code> and it's making an AJAX request to a webservice hosted on <code>https://service.foo.com</code>.  I thought I wouldn't have any cross-domain issues but given IE9 is blocking it, it appears that I do :(</p>
  
  <pre><code>var tempUrl = "https://service.foo.com/dummy.svc/test?hi=bye";
  $.get(tempUrl, "html");
  </code></pre>
  
  <p>As I mentioned, the code works in the other 3 browsers, just not IE9. (I'm only concerned about IE9, not IE8 or older).</p>
  
  <p>I did some digging and found <a href="http://www.google.com/url?sa=t&amp;source=web&amp;cd=2&amp;ved=0CB0QFjAB&amp;url=http://msdn.microsoft.com/en-us/library/dd573303%28v=vs.85%29.aspx&amp;ei=pHkBTsmrMbLXiAKJupWsCA&amp;usg=AFQjCNF6sVWDEUOoOJctoSgSYm_7WeBTJw" rel="noreferrer">this article</a> on MSDN that says:</p>
  
  <blockquote>
    <p>Cross-domain requests require mutual
    consent between the Web page and the
    server. You can initiate a
    cross-domain request in your Web page
    by creating an XDomainRequest object
    off the window object and opening a
    connection to a particular domain. The
    browser will request data from the
    domain's server by sending an Origin
    header with the value of the origin.
    It will only complete the connection
    if the server responds with an
    Access-Control-Allow-Origin header of
    either * or the exact URL of the
    requesting page. This behavior is part
    of the World Wide Web Consortium
    (W3C)'s Web Application Working
    Group's draft framework on client-side
    cross-domain communication that the
    XDomainRequest object integrates with.</p>
  </blockquote>
  
  <p>Before I go down the path of using XDR I wanted to verify with people smarter than me whether this is the right approach or not.</p>
  
  <ol>
  <li>Add <code>Response.AddHeader("Access-Control-Allow-Origin", "*");</code> to my page</li>
  <li>Create condition jscript code that detects IE9 and uses XDR instead of the regular jquery call I'm using with <code>$.get</code>. </li>
  </ol>
  
  <p>Am I totally off or is this the right way to go about this?</p>
  
  <p>(Assuming it's the right way to go, where does the <code>Acecss-Control-Allow-Origin</code> response header go -- on my page at <a href="http://foo.com/test.aspx" rel="noreferrer">http://foo.com/test.aspx</a> or on the webservice at <a href="https://service.foo.com" rel="noreferrer">https://service.foo.com</a>?)</p>