title: XmlHttpRequest CORS POST sent without cookies
body: <p>I have a Rails service returning data for my AngularJS frontend application. The service is configured to allow CORS requests by returning the adequate headers.</p>
  
  <p>When I make a GET request to receive data, the CORS headers are sent, as well as the session cookie that I have previously received on login, you can see for yourself:</p>
  
  <pre><code>Request URL:http://10.211.194.121:3000/valoradores
  Request Method:GET
  Status Code:200 OK
  
  Request Headers
  Accept:application/json, text/plain, */*
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8
  Cache-Control:no-cache
  Connection:keep-alive
  Cookie:_gestisol_session=BAh7B0kiDHVzZXJfaWQGOgZFRmkASSIPc2Vzc2lvbl9pZAY7AEZJIiVmYTg3YTIxMjcxZWMxNjZiMjBmYWZiODM1ODQzMjZkYQY7AFQ%3D--df348feea08d39cbc9c817e49770e17e8f10b375
  Host:10.211.194.121:3000
  Origin:http://10.211.194.121:8999
  Pragma:no-cache
  Referer:http://10.211.194.121:8999/
  User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
  X-Requested-With:XMLHttpRequest
  
  Response Headers
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin
  Access-Control-Allow-Methods:GET,POST,OPTIONS
  Access-Control-Allow-Origin:http://10.211.194.121:8999
  Access-Control-Max-Age:1728000
  Cache-Control:max-age=0, private, must-revalidate
  Connection:Keep-Alive
  Content-Length:5389
  Content-Type:application/json; charset=utf-8
  Date:Mon, 04 Nov 2013 14:30:51 GMT
  Etag:"2470d69bf6db243fbb337a5fb3543bb8"
  Server:WEBrick/1.3.1 (Ruby/1.9.3/2011-10-30)
  X-Request-Id:15027b3d323ad0adef7e06103e5aa3a7
  X-Runtime:0.017379
  X-Ua-Compatible:IE=Edge
  </code></pre>
  
  <p>Everything is right and I get my data back. </p>
  
  <p>But when I make a POST request, neither the CORS headers nor the session cookie are sent along the request, and the POST is cancelled at the server as it has no session identifier. These are the headers of the request:</p>
  
  <pre><code>Request URL:http://10.211.194.121:3000/valoraciones
  
  Request Headers
  Accept:application/json, text/plain, */*
  Cache-Control:no-cache
  Content-Type:application/json;charset=UTF-8
  Origin:http://10.211.194.121:8999
  Pragma:no-cache
  Referer:http://10.211.194.121:8999/
  User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
  X-Requested-With:XMLHttpRequest
  
  Request Payload
  {valoracione:{revisiones_id:1, valoradores_id:1}}
  valoracione: {revisiones_id:1, valoradores_id:1}
  </code></pre>
  
  <p>And the service answers with a 403 because the request does not contain the session cookie.</p>
  
  <p>I don't know why the POST request fails, as the $resource is configured just like the other one and I have defined the default for $httpProvider to send the credentials (and it works right as the GET request succeeds):</p>
  
  <pre><code>  .config(['$httpProvider', function($httpProvider) {
       $httpProvider.defaults.withCredentials = true;
      }])
  </code></pre>
  
  <p>This is the failing resource when I call $save() on an instance:</p>
  
  <pre><code>'use strict';
  
  angular.module('gestisolApp')
    .service('ValoracionesService', ['$resource', 'API_BASE_URL', function ValoracionesService($resource, API_BASE_URL) {
      this.valoraciones = $resource(API_BASE_URL + '/valoraciones');
    }]);
  </code></pre>
  
  <p>And this is the service that succeeds with the query() call:</p>
  
  <pre><code>'use strict';
  
  angular.module('gestisolApp')
    .service('ValoradoresService', ['$resource', 'API_BASE_URL', function ValoradoresService($resource, API_BASE_URL) {
      this.valoradores = $resource(API_BASE_URL + '/valoradores');
    }]);
  </code></pre>
  
  <p>They are much like the same.</p>
  
  <p>Does anybody know why the POST is sent without the session cookie?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>Just to complete the information, preflight is handled by the following method, and is handled OK as the request before the failing POST is an OPTIONS that succeeds with a 200 response code:</p>
  
  <pre><code>def cors_preflight_check
          headers['Access-Control-Allow-Origin'] = 'http://10.211.194.121:8999'
          headers['Access-Control-Allow-Methods'] = 'GET,POST,OPTIONS'
          headers['Access-Control-Allow-Headers'] = 'X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin'
          headers['Access-Control-Allow-Credentials'] = 'true'
          headers['Access-Control-Max-Age'] = '1728000'
          render :nothing =&gt; true, :status =&gt; 200, :content_type =&gt; 'text/html'
  end
  </code></pre>
  
  <p>This is the CORS OPTIONS request/response exchange previous to the failing POST:</p>
  
  <pre><code>Request URL:http://10.211.194.121:3000/valoraciones
  Request Method:OPTIONS
  Status Code:200 OK
  
  Request Headers
  Accept:*/*
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8
  Access-Control-Request-Headers:accept, x-requested-with, content-type
  Access-Control-Request-Method:POST
  Connection:keep-alive
  Host:10.211.194.121:3000
  Origin:http://10.211.194.121:8999
  Referer:http://10.211.194.121:8999/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
  
  Response Headers
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin
  Access-Control-Allow-Methods:GET,POST,OPTIONS
  Access-Control-Allow-Origin:http://10.211.194.121:8999
  Access-Control-Max-Age:1728000
  Cache-Control:max-age=0, private, must-revalidate
  Connection:Keep-Alive
  Content-Length:1
  Content-Type:text/html; charset=utf-8
  Date:Mon, 04 Nov 2013 15:57:38 GMT
  Etag:"7215ee9c7d9dc229d2921a40e899ec5f"
  Server:WEBrick/1.3.1 (Ruby/1.9.3/2011-10-30)
  X-Request-Id:6aa5bb4359d54ab5bfd169e530720fa9
  X-Runtime:0.003851
  X-Ua-Compatible:IE=Edge
  </code></pre>
  
  <p><strong>Edit 2</strong>: I have changed the title to reflect clearly my problem</p>