title: CORS preflight request returning "403 Forbidden"; subsequent request then only sending in Chrome
body: <p>After failure using pluploader in <a href="https://stackoverflow.com/questions/16144879/plupload-runtimes-returning-403-forbidden-error-when-trying-to-access-upload-php">this question</a>, I'm now trying <a href="http://fineuploader.com/" rel="noreferrer">FineUploader</a>.</p>
  
  <p>After reading up on CORS, I've implemented various headers on my IIS6 server.</p>
  
  <p>What seems to happen is that my script fires the first (<code>preflight</code>) authorisation request, which fails, but Chrome allows the second (<code>standard</code>) request to send anyway - Firefox does not. I presume this is actually a bug on behalf of Chrome, but at least it has allowed me to work out that my script is <em>probably</em> working correctly.</p>
  
  <p>Here is the first (preflight) request as seen in Chrome and FF:</p>
  
  <pre><code>OPTIONS /frog/LOTS/upload/php.php HTTP/1.1
  Host: staff.curriculum.local
  User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:14.0) Gecko/20100101 Firefox/14.0.1
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-us,en;q=0.5
  Accept-Encoding: gzip, deflate
  Connection: keep-alive
  Origin: http://frogserver.curriculum.local
  Access-Control-Request-Method: POST
  Access-Control-Request-Headers: cache-control,x-requested-with
  Pragma: no-cache
  Cache-Control: no-cache
  </code></pre>
  
  <p>The <code>Access-Control...</code> headers are those that I've added to IIS.</p>
  
  <p>And here are my response headers:</p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Content-Length: 1758
  Content-Type: text/html
  Server: Microsoft-IIS/6.0
  x-powered-by: ASP.NET
  Access-Control-Allow-Origin: http://frogserver.curriculum.local
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Cache-Control
  Access-Control-Allow-Methods: OPTIONS, GET, POST
  Access-Control-Expose-Headers: Origin, X-Requested-With
  Date: Mon, 22 Apr 2013 15:19:20 GMT
  </code></pre>
  
  <p>I've tried to compare the two side by side but I can't find any missing headers which would cause the <code>preflight</code> request to return a <code>403 Forbidden</code> error.</p>
  
  <p><img src="https://i.stack.imgur.com/eNfvt.png" alt="403 Forbidden"></p>
  
  <p>I haven't included my PHP source as it's a lot of code. Suffice to say that it does work in Chrome and that the file is correctly uploaded, so the script <em>should</em> be correct. The only thing which may be worth mentioning is that I've got a <code>header("Content-Type: text/plain");</code> at the start of my script. Changing that to <code>text/html</code> makes no difference to Chrome nor FireFox.</p>
  
  <p>The JavaScript is quite straightforward:</p>
  
  <pre><code>$('#jquery-wrapped-fine-uploader').fineUploader({
      request: {
          endpoint: 'http://staff.curriculum.local/frog/LOTS/upload/php.php'
      },
      cors: {
          expected: true, //all requests are expected to be cross-domain requests
          sendCredentials: true //if you want cookies to be sent along with the request
      }
  });
  </code></pre>
  
  <p>Can anyone help? I've spent literally 8 hours on this single problem today and I'm >&lt; close to ripping my own face off....!!</p>
  
  <p>Thanks in advance,</p>