I have a Rails service returning data for my AngularJS frontend application. The service is configured to allow CORS requests by returning the adequate headers.

When I make a GET request to receive data, the CORS headers are sent, as well as the session cookie that I have previously received on login, you can see for yourself:

Request URL:http://10.211.194.121:3000/valoradores

Request Method:GET

Status Code:200 OK



Request Headers

Accept:application/json, text/plain, */*

Accept-Encoding:gzip,deflate,sdch

Accept-Language:en-US,en;q=0.8

Cache-Control:no-cache

Connection:keep-alive

Cookie:_gestisol_session=BAh7B0kiDHVzZXJfaWQGOgZFRmkASSIPc2Vzc2lvbl9pZAY7AEZJIiVmYTg3YTIxMjcxZWMxNjZiMjBmYWZiODM1ODQzMjZkYQY7AFQ%3D--df348feea08d39cbc9c817e49770e17e8f10b375

Host:10.211.194.121:3000

Origin:http://10.211.194.121:8999

Pragma:no-cache

Referer:http://10.211.194.121:8999/

User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36

X-Requested-With:XMLHttpRequest



Response Headers

Access-Control-Allow-Credentials:true

Access-Control-Allow-Headers:X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin

Access-Control-Allow-Methods:GET,POST,OPTIONS

Access-Control-Allow-Origin:http://10.211.194.121:8999

Access-Control-Max-Age:1728000

Cache-Control:max-age=0, private, must-revalidate

Connection:Keep-Alive

Content-Length:5389

Content-Type:application/json; charset=utf-8

Date:Mon, 04 Nov 2013 14:30:51 GMT

Etag:2470d69bf6db243fbb337a5fb3543bb8

Server:WEBrick/1.3.1 (Ruby/1.9.3/2011-10-30)

X-Request-Id:15027b3d323ad0adef7e06103e5aa3a7

X-Runtime:0.017379

X-Ua-Compatible:IE=Edge

Everything is right and I get my data back.

But when I make a POST request, neither the CORS headers nor the session cookie are sent along the request, and the POST is cancelled at the server as it has no session identifier. These are the headers of the request:

Request URL:http://10.211.194.121:3000/valoraciones



Request Headers

Accept:application/json, text/plain, */*

Cache-Control:no-cache

Content-Type:application/json;charset=UTF-8

Origin:http://10.211.194.121:8999

Pragma:no-cache

Referer:http://10.211.194.121:8999/

User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36

X-Requested-With:XMLHttpRequest



Request Payload

{valoracione:{revisiones_id:1, valoradores_id:1}}

valoracione: {revisiones_id:1, valoradores_id:1}

And the service answers with a 403 because the request does not contain the session cookie.

I don't know why the POST request fails, as the $resource is configured just like the other one and I have defined the default for $httpProvider to send the credentials (and it works right as the GET request succeeds):

  .config(['$httpProvider', function($httpProvider) {

     $httpProvider.defaults.withCredentials = true;

    }])

This is the failing resource when I call $save() on an instance:

'use strict';



angular.module('gestisolApp')

  .service('ValoracionesService', ['$resource', 'API_BASE_URL', function ValoracionesService($resource, API_BASE_URL) {

    this.valoraciones = $resource(API_BASE_URL + '/valoraciones');

  }]);

And this is the service that succeeds with the query() call:

'use strict';



angular.module('gestisolApp')

  .service('ValoradoresService', ['$resource', 'API_BASE_URL', function ValoradoresService($resource, API_BASE_URL) {

    this.valoradores = $resource(API_BASE_URL + '/valoradores');

  }]);

They are much like the same.

Does anybody know why the POST is sent without the session cookie?

Edit

Just to complete the information, preflight is handled by the following method, and is handled OK as the request before the failing POST is an OPTIONS that succeeds with a 200 response code:

def cors_preflight_check

        headers['Access-Control-Allow-Origin'] = 'http://10.211.194.121:8999'

        headers['Access-Control-Allow-Methods'] = 'GET,POST,OPTIONS'

        headers['Access-Control-Allow-Headers'] = 'X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin'

        headers['Access-Control-Allow-Credentials'] = 'true'

        headers['Access-Control-Max-Age'] = '1728000'

        render :nothing => true, :status => 200, :content_type => 'text/html'

end

This is the CORS OPTIONS request/response exchange previous to the failing POST:

Request URL:http://10.211.194.121:3000/valoraciones

Request Method:OPTIONS

Status Code:200 OK



Request Headers

Accept:*/*

Accept-Encoding:gzip,deflate,sdch

Accept-Language:en-US,en;q=0.8

Access-Control-Request-Headers:accept, x-requested-with, content-type

Access-Control-Request-Method:POST

Connection:keep-alive

Host:10.211.194.121:3000

Origin:http://10.211.194.121:8999

Referer:http://10.211.194.121:8999/

User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36



Response Headers

Access-Control-Allow-Credentials:true

Access-Control-Allow-Headers:X-Requested-With,X-Prototype-Version,Content-Type,Cache-Control,Pragma,Origin

Access-Control-Allow-Methods:GET,POST,OPTIONS

Access-Control-Allow-Origin:http://10.211.194.121:8999

Access-Control-Max-Age:1728000

Cache-Control:max-age=0, private, must-revalidate

Connection:Keep-Alive

Content-Length:1

Content-Type:text/html; charset=utf-8

Date:Mon, 04 Nov 2013 15:57:38 GMT

Etag:7215ee9c7d9dc229d2921a40e899ec5f

Server:WEBrick/1.3.1 (Ruby/1.9.3/2011-10-30)

X-Request-Id:6aa5bb4359d54ab5bfd169e530720fa9

X-Runtime:0.003851

X-Ua-Compatible:IE=Edge

Edit 2: I have changed the title to reflect clearly my problem