Status code = 0 when using xhrFields: { withCredentials: true } in jQuery $ajax call with Firefox

Question

I'm using

xhrFields : { 
  withCredentials: true 
} 

in jQuery $ajax calls, in order to send session cookies within my queries.

The call gives a correct status code on my apache logs (401/200 depending if the cookie is set), but Firefox always receives a status=0 (i.e. an error in $.ajax()) If I remove this xhrFields section, status code is OK (but cookies are not sent)

Here's the response object I receive in Firefox with the xhrFields setup:

{"readyState":0,"responseText":"","status":0,"statusText":"error"}

My Apache config is CORS-enabled, and also allows Access-Control-Allow-Credentials (here are the corresponding HTTP headers)

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

Is there something missing, either in the AJAX call, or on the webserver config?

NB: This works perfectly fine in Chrome

Answer 1

You probably have to specify the Access-Control-Allow-Origin header more explicitly than *.

https://developer.mozilla.org/En/HTTP_access_control#Requests_with_credentials says:

Important note: when responding to a credentialed request, server must specify a domain, and cannot use wild carding.