title: Cross domain POST query using Cross-Origin Resource Sharing getting no data back
body: <p>I'm sending data cross domain via a POST request but the response isn't working, specifically, jQuery's success handler never gets called.</p>
  
  <p>Stuff being used: Django, Apache, jQuery.</p>
  
  <p>So, I set up a request rather similar to this:</p>
  
  <pre><code>$.ajax({
      url: "http://somesite.com/someplace",
      type: "POST",
      cache: false,
      dataType: "json",
      data: { ... },
      success: function( msg ) {
          alert(msg);
      },
  });
  </code></pre>
  
  <p>As you well know, <a href="http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing" rel="noreferrer">CORS</a> allows me to respond to an <code>OPTIONS</code> query appropriately to say "Yes, you can POST to me". Which I'm doing. Firebug confirms I'm getting my <code>200</code> status code and that the return type is in fact <code>application/json</code>. However, Firebug also confirms that the success handler in the above is <em>not</em> being called.</p>
  
  <p>For reference, my response to <code>OPTIONS</code> is:</p>
  
  <pre><code>elif request.method == "OPTIONS":
      response = HttpResponse("")
      response['Access-Control-Allow-Origin'] = "*"
      response['Access-Control-Allow-Methods'] = "POST, GET, OPTIONS"
      response['Access-Control-Allow-Headers'] = "X-Requested-With"
      return response
  </code></pre>
  
  <p>In contrast, if I set up a <code>complete: function()...</code> handler it works.</p>
  
  <p>So, question is: what's happening (or not) and why? I am getting data fine, I'd just like to be able to return the response.</p>
  
  <hr>
  
  <p><strong>Update</strong>: <em>This fixes my issue on some browsers but since I don't have a complete definite explanation to this behaviour I'm leaving it open</em>.</p>
  
  <p>Ok, so I read <a href="http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing" rel="noreferrer">the manual</a> and what I understand of it, the algorithm applied is roughly this:</p>
  
  <ol>
  <li>User agents may implement a preflight call. This is the <code>OPTIONS</code> request. The idea is that they make this request which gives them an answer with respect to the requested resource, which they are then supposed to cache. <strong>I'm not passing back a max-age</strong> field, so I suspect whilst success is being returned and the X-request allowed, there is nothing in the user agent's cache which permitted me to make it, so the default rules (isolate the request) are applied.</li>
  <li>When you make the actual request, I believe the user agent is supposed to inspect the pre-flight cache for permissions. Without my max-age field, I believe it isn't finding these permissions. However, responding with the same headers on <code>POST</code> appears to allow Firefox and Google Chrome to view the response. Opera can not. IE remains untested at the moment.</li>
  </ol>
  
  <p>I do not currently understand and it is not clear from the manual (to me at least) whether a CORS request should also answer with these headers in the request as well as the <code>OPTIONS</code>. I shall experiment with the <code>Max-Age</code> header and see what that allows or does not allow. However, I'm still short of some definite authoritative understanding on the issue so if there is someone on here who knows, I'm all ears.</p>