title: Why browser do not follow redirects using XMLHTTPRequest and CORS?
body: <p>I am writing a web application for some service using RESTful API. The API is available at <code>https://api.example</code> and app at <code>https://app.example</code>. Simple GET requests using CORS are working just fine in Chrome and Firefox. Some method accept data via POST and return 303 code with new uri in Location header.</p>
  
  <p>Preflight OPTIONS request is fine:</p>
  
  <pre class="lang-none prettyprint-override"><code>Request Method:OPTIONS
  Status Code:200 OK
  </code></pre>
  
  <p>Request Headers</p>
  
  <pre class="lang-none prettyprint-override"><code>Accept:*/*
  Accept-Charset:UTF-8,*;q=0.5
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8,ru;q=0.6
  Access-Control-Request-Headers:origin, authorization, content-type
  Access-Control-Request-Method:POST
  Connection:keep-alive
  DNT:1
  Host:api.example
  Origin:https://app.example
  Referer:https://app.example/app/
  User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.32 (KHTML, like Gecko) Chrome/27.0.1425.0 Safari/537.32 SUSE/27.0.1425.0
  </code></pre>
  
  <p>Response Headers</p>
  
  <pre class="lang-none prettyprint-override"><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:Authorization, Content-Type
  Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
  Access-Control-Allow-Origin:https://app.example
  Access-Control-Expose-Headers:*
  Access-Control-Max-Age:3628800
  Connection:keep-alive
  Content-Length:0
  Date:Sun, 05 May 2013 15:22:50 GMT
  Server:nginx/1.2.5
  </code></pre>
  
  <p>Then the actual request just stop after receiving 303:</p>
  
  <pre class="lang-none prettyprint-override"><code>Request URL:https://api.example
  Request Method:POST
  Status Code:HTTP/1.1 303 See Other
  </code></pre>
  
  <p>Response headers:</p>
  
  <pre class="lang-none prettyprint-override"><code>Server:nginx/1.2.5
  Location:https://api.example/some_url
  Date:Sun, 05 May 2013 15:27:49 GMT
  Content-Type:application/json
  Content-Length:0
  Connection:keep-alive
  Access-Control-Max-Age:3628800
  Access-Control-Expose-Headers:*
  Access-Control-Allow-Origin:https://app.example
  Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
  Access-Control-Allow-Headers:Authorization, Content-Type
  Access-Control-Allow-Credentials:true
  </code></pre>
  
  <p>By RFC user agent should follow redirects, but Chrome and FF seems doesn't behave as expected. Is it a browsers' bug or I am doing something wrong?</p>
  
  <p><strong>update:</strong> If I start chromium with --disable-web-security everything works fine.</p>