title: Chrome not adding headers in ajax requests from iframe, Firefox ok
body: <p>I've got a situation where I'm sending ajax requests from iframe, to same domain as original page, this Iframe loaded from same domain. Say, original page address is <a href="http://server/client" rel="nofollow noreferrer">http://server/client</a> and iframe src is <a href="http://server/client/addin1/view.html" rel="nofollow noreferrer">http://server/client/addin1/view.html</a></p>
  
  <p>From Iframe I make initial xhr request to api: POST <a href="http://server/api/connect" rel="nofollow noreferrer">http://server/api/connect</a> which returns 201 with token in response header and a cookie.
  Now I make next call to different api method, say, GET <a href="http://server/api/status" rel="nofollow noreferrer">http://server/api/status</a>, but in this case I add the token header, and I assume the received cookie will be included by browser - it's HttpOnly, my xhr has withCredentials: true.</p>
  
  <p>The magic is: in FF it works ok, both token and cookie are set and sent, in chrome the token header is not added and cookie is not sent. I've verified that in both cases xhr.setRequestHeader(...) gets called, and just to be 100% sure I've verified with wireshark what gets actually sent.</p>
  
  <p>Any idea why chrome, behaves differently from FF? Maybe I'm missing sth simple.</p>
  
  <p>thanks,
  Łukasz</p>