title: Why is this CORS request failing only in Firefox?
body: <p>I'm implementing CORS with credentials and a preflight request and I'm a bit mystified why the preflight request consistently fails in Firefox 30 but works in Safari (7.0.2) and Chrome 35. I think this issue is different from "<a href="https://stackoverflow.com/questions/15734031/why-does-the-preflight-options-request-of-an-authenticated-cors-request-work-in">Why does the preflight OPTIONS request of an authenticated CORS request work in Chrome but not Firefox?</a>" because I am not getting a 401, but rather a CORS-specific message from the browser client:</p>
  
  <blockquote>
    <p>"Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://myurl.dev.com" rel="noreferrer">http://myurl.dev.com</a>. This can be fixed by moving the resource to the same domain or enabling CORS."</p>
  </blockquote>
  
  <p>Without showing source code, here's what I'm doing:</p>
  
  <p><strong>On the server</strong>:</p>
  
  <p>Headers for OPTIONS response:</p>
  
  <ul>
  <li>Access-Control-Allow-Origin: [[copy origin from the request here]]</li>
  <li>Access-Control-Allow-Methods: "POST GET OPTIONS"</li>
  <li>Access-Control-Allow-Headers: "X-Requested-With"</li>
  <li>Access-Control-Allow-Credentials: "true"</li>
  </ul>
  
  <p>Headers for POST response:</p>
  
  <ul>
  <li>Access-Control-Allow-Origin: [[copy origin from the request here]]</li>
  <li>Access-Control-Allow-Credentials: "true"</li>
  </ul>
  
  <p><strong>In the browser client:</strong></p>
  
  <pre><code>jQuery.ajax({
    url: requestUrl,
    type: 'POST',
    data: getData(),
    xhrFields: {
      withCredentials: true
    }
  });
  </code></pre>
  
  <p>Per the spec, this will trigger a OPTIONS preflight request which needs to have the CORS headers in its response.  I've read through the W3C spec several times and I can't identify what I'm doing wrong, if anything, in that preflight response.</p>