title: Set-Cookie on Browser with Ajax Request via CORS
body: <p>Attempting to implement an ajax login / signup process (no refresh site with authentication).  Using cookies for preserving state.  I thought I'd have this right by now but for some reason browser doesn't set cookies after it gets them back from the server.  Can anyone help?  Here are the request and response headers:</p>
  
  <pre><code>Request URL:http://api.site.dev/v1/login
  Request Method:POST
  Status Code:200 OK
  </code></pre>
  
  <p><strong>Request Headers</strong></p>
  
  <pre><code>Accept:application/json, text/plain, */*
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8
  Connection:keep-alive
  Content-Length:57
  Content-Type:application/json;charset=UTF-8
  Host:api.site.dev
  Origin:http://site.dev
  Referer:http://site.dev/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.101 Safari/537.11
  withCredentials:true
  X-Requested-With:XMLHttpRequest
  Request Payload
  {"email":"calvinfroedge@gmail.com","password":"foobar"}
  </code></pre>
  
  <p><strong>Response Headers</strong></p>
  
  <pre><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:X-Requested-With, Content-Type, withCredentials
  Access-Control-Allow-Methods:GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Origin:http://site.dev
  Connection:Keep-Alive
  Content-Length:19
  Content-Type:application/json
  Date:Tue, 08 Jan 2013 18:23:14 GMT
  Keep-Alive:timeout=5, max=99
  Server:Apache/2.2.22 (Unix) DAV/2 PHP/5.4.7 mod_ssl/2.2.22 OpenSSL/0.9.8r
  Set-Cookie:site=%2B1THQQ%2BbZkEwTYFvXFVV5fxi00l2K%2B6fvt9SuHACTNsEwUGzDSUckt38ZeDsNbZSsqzHmPMWRLc84eDLZzh8%2Fw%3D%3D; expires=Thu, 10-Jan-2013 18:23:14 GMT; path=/; domain=.site.dev; httponly
  X-Powered-By:PHP/5.4.7
  </code></pre>
  
  <p>I also see the cookie in chrome network tools, as returned from the server:</p>
  
  <p><strong>Response Cookies</strong></p>
  
  <pre><code>Name: site
  Value: %2B1THQQ%2BbZkEwTYFvXFVV5fxi00l2K%2B6fvt9SuHACTNsEwUGzDSUckt38ZeDsNbZSsqzHmPMWRLc84eDLZzh8%2Fw%3D%3D
  Domain: .site.dev
  Path: /
  Expires: Session
  Size: 196
  Http: ✓
  </code></pre>