title: Cordova AJAX request not working
body: <p>I'm using Cordova 5.3.1, and I seem to be totally unable to make any network requests without errors. If I add</p>
  
  <pre><code>$.ajax( "http://foo.bar.com/getfeed" )
  .done(function() {
      alert( "success" );
  })
  .fail(function(jqXHR, textStatus, errorThrown) {
      alert( errorThrown );
  })
  .always(function() {
      alert( "complete" );
  });
  </code></pre>
  
  <p>to <code>index.js</code> it fails and alerts <code>Error: SecurityError: DOM Exception 18</code> in iOS and <code>SecurityError: Failed to execute 'open on 'XMLHttpRequest': Refused to connect to 'http://foo.bar.com/getfeed' because it violates the document's Content Security Policy.</code>, so it look like CORS is being blocked.</p>
  
  <p>Currently the <a href="https://github.com/apache/cordova-plugin-whitelist" rel="nofollow noreferrer">whitelist plugin</a> doesn't install properly when you install it as per this <a href="https://stackoverflow.com/questions/30991828/cordova-plugin-whitelist-failed-asking-for-cordova-ios-4">SO post</a> and this <a href="https://issues.apache.org/jira/browse/CB-9232" rel="nofollow noreferrer">JIRA issue</a>, basically it requires the iOS platform <code>&gt;=4.0.0-dev</code>. I can still force it to install an older version with:</p>
  
  <pre><code>cordova plugin add cordova-plugin-whitelist@1.0.0
  </code></pre>
  
  <p>as per the suggestions in the SO post and JIRA issue.</p>
  
  <p>However I am still unable to make any http requests to external domains. I still get the same 'DOM Exception 18' error. My <code>config.xml</code> file is currently</p>
  
  <pre><code>&lt;?xml version='1.0' encoding='utf-8'?&gt;
  &lt;widget id="com.company.pearstest" version="0.0.1" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0"&gt;
      &lt;name&gt;CORS test&lt;/name&gt;
      &lt;description&gt;
          A sample Apache Cordova application that responds to the deviceready event.
      &lt;/description&gt;
      &lt;author email="dev@cordova.apache.org" href="http://cordova.io"&gt;
          Apache Cordova Team
      &lt;/author&gt;
      &lt;content src="index.html" /&gt;
      &lt;plugin name="cordova-plugin-whitelist" version="1" /&gt;
      &lt;access origin="*" /&gt;
      &lt;allow-intent href="http://*/*" /&gt;
      &lt;allow-intent href="https://*/*" /&gt;
      &lt;allow-intent href="tel:*" /&gt;
      &lt;allow-intent href="sms:*" /&gt;
      &lt;allow-intent href="mailto:*" /&gt;
      &lt;allow-intent href="geo:*" /&gt;
      &lt;platform name="android"&gt;
          &lt;allow-intent href="market:*" /&gt;
      &lt;/platform&gt;
      &lt;platform name="ios"&gt;
          &lt;allow-intent href="itms:*" /&gt;
          &lt;allow-intent href="itms-apps:*" /&gt;
      &lt;/platform&gt;
  &lt;/widget&gt;
  </code></pre>
  
  <p>The tag for allowing different origins seems to have changed over different versions lately and as a result I've tried every conceivable combination of various different tags in this file.</p>
  
  <p>I've also checked <code>$.support.cors</code> to make sure that jQuery allows CORS and it does (jQuery is working properly as the AJAX requests are running the fail callback rather than silently failing). </p>
  
  <p>I also have the meta tag</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' https:"&gt;
  </code></pre>
  
  <p>in <code>index.html</code>. I suspect this isn't an issue with my emulator blocking http requests as it's a problem in both Android and iOS emulators and on an Android device. </p>
  
  <p>Does anyone have any idea why I'm <em>still</em> having CORS issues? Thanks.</p>