title: CORS $.ajax session cookies (access-control-allow-credentials & withCredentials=true)
body: <p>I realize this question has been asked a dozen or more times and each response given indicates I am doing it right but perhaps I am missing something.</p>
  
  <p>AJAX serves up CORS request like so...</p>
  
  <pre><code>$.ajax({
  url: 'someotherdomain.com',
  type: 'post',
  data: {key: 'value'},
  dataType: 'json',
  async: false,
  crossDomain: true,
  beforeSend: function(xhr){
      xhr.withCredentials = true;
  },
  success: function(x, status, xhr){
  
  },
  error: function(xhr, status, error){
  
  }
  });
  </code></pre>
  
  <p>PHP serves up CORS requests like so...</p>
  
  <pre><code>header('Access-Control-Max-Age: 1728000');
  header('Access-Control-Allow-Origin: http://someotherdomain.com');
  header('Access-Control-Allow-Methods: POST');
  header('Access-Control-Allow-Headers: Content-MD5, X-Alt-Referer');
  header('Access-Control-Allow-Credentials: true');
  header("Content-Type: application/json; charset=utf-8");
  </code></pre>
  
  <p>According to all documentation as long as the 'Access-Control-Allow-Credentials' server side header, and the 'withCredentials=true' client side header is set session cookie handling between the domains should be transparent. Am I missing something?</p>