title: Chrome & CORS with 302 redirects and withCredentials=true
body: <p>I am having trouble with Chromium-based browsers and CORS requests that
  include 302 redirects.  More specifically, I am having trouble with Chromium
  versions 34-42 inclusive; 43 and later works, and it seems 33 and earlier
  versions worked as well (I didn't test too far past 33, 28 worked).</p>
  
  <p>My XHR request uses withCredentials=true, so Access-Control-Allow-Origin="*"
  is not allowed; the server must reply with an Access-Control-Allow-Origin
  header that echoes the incoming request's Origin header.</p>
  
  <p>After receiving the first 302, Chromium 43 and later sends "Origin: null" as
  part of the redirected request, and accepts 'Access-Control-Allow-Origin: null"
  in response (as does Firefox).  </p>
  
  <p>The Chromium series of 34-42 all send the host name as Origin for all requests,
  and several issues from this time indicate that CORS redirects were <em>only</em>
  supported with Access-Control-Allow-Origin set to "*", and that "the original
  XHR must not have allow-credentials set to true", example:</p>
  
  <ul>
  <li><a href="https://code.google.com/p/chromium/issues/detail?id=154967" rel="noreferrer">https://code.google.com/p/chromium/issues/detail?id=154967</a></li>
  </ul>
  
  <p>I am hoping this is a misconception, and there is something as an app
  developer I can do on the client and/or server to coerce those versions to
  not cancel the redirect, or failing that, ideas for a workaround.</p>
  
  <p>Version 33 &amp; earlier sent the entire host name for every request, and the full
  roundtrip works.</p>
  
  <p>One possibility for a workaround I have been experimenting with stems from the
  fact that, I actually do <em>not</em> need withCredentials=true for the cross-domain
  request, I only need it for the redirect back to the origin host to exchange
  cookie-based authentication for an access_token, but I could not find a way to
  get the client to send a cookie when following the 302 to itself unless it was
  also sent with the original cross-domain request.</p>
  
  <p>To illustrate, here are excerpts from a chrome://net-internals/#events log for
  a successful request using Chrome 43:</p>
  
  <pre><code>    [img src]
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437075435614 HTTP/1.1
          Host: media-qa.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1568 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Content-Type: text/html; charset=utf-8
          Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437075435614
  
      [get cross-domain access token]
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437075435614 HTTP/1.1
          Host: qa-app.example.com
          Origin: null
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1762 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
          Access-Control-Allow-Origin: null
          Content-Type: text/html; charset=utf-8
          Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437075435614&amp;access_token=L221i4rC5R8NY2AbP4lIxo7apr6HlIHttKroKkQi3tzUSaL7NE7aoBcLUI432Mast8b/NH7ksFfRhsCOhK7P86Lc4C9GlkRn%2Bze/UBJeG8gbRVlnxdjdzBFfp9kAbYR9onDM9b1bUdRaV1q19it8OL3aBzThrmng1E%2BMmT%2BVyK0qXLqQ6yA/tHfrgyC9XwFbKqW6BQSpLOyVOPHZZ4t3dgzimTD9HJCbLUUjZt7nf7iCAOBcaR9CiUH8vlcP4wkOmXk3AoDslYu6IUZtRHrSs7OplBtTXgmzBlSaum%2BccFzdNu5TuH%2BQkmp2QQHErwRJkUNN9S5ZcRzlXdUGg8%2B698Wh5zYFVa%2B/pEfykkf%2BAuqKjbVicGq%2BgxCYOCuqe4YJU/GPMHsBC6gvVYFmtkDaG4za1N4fvbmBb9u%2BHHZNdW0kvj55N9QgJ86lHZjddvfEivET0TVTo1u0u6Wp/TM4EMXLtMK3urBpEAMWBT9PlE8%3D
  
      [url redirection service adds cloudfront signature]
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437075435614&amp;access_token=L221i4rC5R8NY2AbP4lIxo7apr6HlIHttKroKkQi3tzUSaL7NE7aoBcLUI432Mast8b/NH7ksFfRhsCOhK7P86Lc4C9GlkRn%2Bze/UBJeG8gbRVlnxdjdzBFfp9kAbYR9onDM9b1bUdRaV1q19it8OL3aBzThrmng1E%2BMmT%2BVyK0qXLqQ6yA/tHfrgyC9XwFbKqW6BQSpLOyVOPHZZ4t3dgzimTD9HJCbLUUjZt7nf7iCAOBcaR9CiUH8vlcP4wkOmXk3AoDslYu6IUZtRHrSs7OplBtTXgmzBlSaum%2BccFzdNu5TuH%2BQkmp2QQHErwRJkUNN9S5ZcRzlXdUGg8%2B698Wh5zYFVa%2B/pEfykkf%2BAuqKjbVicGq%2BgxCYOCuqe4YJU/GPMHsBC6gvVYFmtkDaG4za1N4fvbmBb9u%2BHHZNdW0kvj55N9QgJ86lHZjddvfEivET0TVTo1u0u6Wp/TM4EMXLtMK3urBpEAMWBT9PlE8%3D HTTP/1.1
          Host: media-qa.example.com
          Origin: null
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1568 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
          Access-Control-Allow-Origin: null
          Content-Type: text/html; charset=utf-8
          Location: https://gbbrsh.cloudfront.net/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437075499&amp;Signature=RpCVix5lcF5~Arah0WxhSoB3SN7ZfxXIwnaL8EOdlslIz5c9Ycic1wF~sjwTnWD5fxS~SBhexIz37oqjHjED3MTPiXAmuPjO1mQ-V8ACc8N-geWBIvMQRw9kCjCRmtquSs7TynaFqopv0BpQKH2G1xVdfoDaOZZWso7pXnpR50c2NdyDD-WMZNLKJ657Dj4-wCL8ZJdUPOgiXsfcxM1AZGy5P034SCL8JB8ZyEh1bUDszLkQa8lIpsy08mt9t8ZjFcR2i6bqBZNZOquT3jbOEy8VprL4lmtyOmVJaNTaBevZC6rQ6CM~jd~Ya2FockK5bNGYxM043OU71NExS0lHTg__&amp;Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ
          Set-Cookie: [349 bytes were stripped]
  
      [finally, get cloudfront image]
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437075499&amp;Signature=RpCVix5lcF5~Arah0WxhSoB3SN7ZfxXIwnaL8EOdlslIz5c9Ycic1wF~sjwTnWD5fxS~SBhexIz37oqjHjED3MTPiXAmuPjO1mQ-V8ACc8N-geWBIvMQRw9kCjCRmtquSs7TynaFqopv0BpQKH2G1xVdfoDaOZZWso7pXnpR50c2NdyDD-WMZNLKJ657Dj4-wCL8ZJdUPOgiXsfcxM1AZGy5P034SCL8JB8ZyEh1bUDszLkQa8lIpsy08mt9t8ZjFcR2i6bqBZNZOquT3jbOEy8VprL4lmtyOmVJaNTaBevZC6rQ6CM~jd~Ya2FockK5bNGYxM043OU71NExS0lHTg__&amp;Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ HTTP/1.1
          Host: gbbrsh.cloudfront.net
          Origin: null
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 200 OK
          Content-Length: 48776
          Access-Control-Allow-Origin: null
          Access-Control-Allow-Methods: GET
          Access-Control-Max-Age: 3000
          Access-Control-Allow-Credentials: true
          Vary: Origin
  </code></pre>
  
  <p>And here is an unsuccessful log using version 42, note that all the redirects
  using 43 above sent "Origin: null", but 42 sends the host name (which the
  server replies with), and the client cancels the request:</p>
  
  <pre><code>    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437074740624 HTTP/1.1
          Host: media-qa.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1571 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437074740624
  
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437074740624 HTTP/1.1
          Host: qa-app.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1769 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437074740624&amp;access_token=JbXemck/weq2TjoVtgwuXDZB1GgmBqlDix3z5WfsWFlf2aZVmCud99wtAU%2BBErVxm6Lk1MRP1ubM/bf59URPs9uXMLYC%2Bnk6lAYQRUBhO3UmBnZk967W/5f9/1YnfRHQe1Y9fGRSkddQJdzdOwkMAvYSCw%2BN1ofkrb4tYKz9OWja1WRuim82Mt5uzdb5eXVLUnlCCgqt9LjN6yDHPm7UjMwQMG8V0kFPIkL4ZGb/5WfXXa2NJY1Qq3GbFGFQID49vw/XDP6B9q9kRIL4D/NuLUocRUvw5iHZciqygpnJl1GaRcVr%2B5%2BBbKBw3c0Gou4X/ojiewnds2pYPPxNGKploy88l4GcjpGw%2BXmDiP4wUgCojhRporBjp2y87AnaY1k6BSI1j9xHxiSnjXT7pMsyXpBfMYCoAwV/w1Fh1E/Tu1ygXJhaOHAx%2B19BxOIYPWFJVw3djggbkN1jRo%2Bde%2BolGjfEXtFarwfx4nyCeNyYAd0%3D
          Vary: Accept-Encoding
    URL_REQUEST_DELEGATE  [dt=0]
   +URL_REQUEST_DELEGATE  [dt=3]
      DELEGATE_INFO  [dt=3]
      --&gt; delegate_info = "AsyncResourceHandler"
   -URL_REQUEST_DELEGATE
    CANCELLED
  </code></pre>
  
  <p>As I mentioned, if you go back to version 33, it works even though the client
  was sending the host name in the Origin header for all requests:</p>
  
  <pre><code>    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437076851710 HTTP/1.1
          Host: media-qa.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1550 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437076851710
  
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437076851710 HTTP/1.1
          Host: qa-app.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1763 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437076851710&amp;access_token=C30mMVgoZSZtkpm3vgMNfLZEpkKT//%2BiZK5gbR39dvPfIaezfjNMocXJ0UCCH10jcE0yvOIrT8yISHerVvGZlGPy2rr2YwXkh1IsYcl0uNGYOP2bDYyz1cJNAwnRYZ4qS0uctDQiKNGZi3oC10TdIwzhz8aaOFAosRFEjPqrT553aXjpZr2SE4Z73TtU2pd%2B7ILICARbjp0r9yhDAAauJgQHkBAkcLVvW5TARQBeRR1OtXbf0CjN764EZ/2GEqCRhvo0rtVUQGUVpt/Sur9yFYUh1b/rFOZJ0o/Oj8rEUEg2c8p/O1ZrpN8emKMB%2BVWLXG97DPO6QpQmzGvaYCZsUDwGfvPNJ8wCtXEdQF0RzQMv3HG71StD9lK30BB46sDTuP24w7tH4PxqjY0cWBUpaMMz/mKLWuSWY6lerx7ibB7Gp%2B9OsclEHeaxKwFr%2BD63RFPmTwBtHKOF/PjIo%2BbmoxJZ07eJYAEYXDtfoLmFvM8%3D
          Vary: Accept-Encoding
  
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437076851710&amp;access_token=C30mMVgoZSZtkpm3vgMNfLZEpkKT//%2BiZK5gbR39dvPfIaezfjNMocXJ0UCCH10jcE0yvOIrT8yISHerVvGZlGPy2rr2YwXkh1IsYcl0uNGYOP2bDYyz1cJNAwnRYZ4qS0uctDQiKNGZi3oC10TdIwzhz8aaOFAosRFEjPqrT553aXjpZr2SE4Z73TtU2pd%2B7ILICARbjp0r9yhDAAauJgQHkBAkcLVvW5TARQBeRR1OtXbf0CjN764EZ/2GEqCRhvo0rtVUQGUVpt/Sur9yFYUh1b/rFOZJ0o/Oj8rEUEg2c8p/O1ZrpN8emKMB%2BVWLXG97DPO6QpQmzGvaYCZsUDwGfvPNJ8wCtXEdQF0RzQMv3HG71StD9lK30BB46sDTuP24w7tH4PxqjY0cWBUpaMMz/mKLWuSWY6lerx7ibB7Gp%2B9OsclEHeaxKwFr%2BD63RFPmTwBtHKOF/PjIo%2BbmoxJZ07eJYAEYXDtfoLmFvM8%3D HTTP/1.1
          Host: media-qa.example.com
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
          Cookie: [1550 bytes were stripped]
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 302 FOUND
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
          Access-Control-Allow-Origin: https://qa-app.example.com
          Location: https://gbbrsh.cloudfront.net/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437076916&amp;Signature=WBDGSQXer-zAREYgiD1~DA8pUaNUBha4WrUFt-WI5Soh4Z-5ayw35UocOG7DuC9FOnAQAeU5Nvp8hKdofDB--ic4aMH0e~LmHaJ38GtP-lHnyyfQDpjJOEmGM2GY3sB0KG7qa8~eTXX9jKDJTCG9Hkf0EpievuWwiXEKGYaSbe0tkR4CLyhND3sIDJbFGCQQZ7NmhMB-3vOsqDKYKKz9SebuiqO0qbL8SvqBkMEiufXCF2MriR4hVDEjFQssE3ysBbhiMlkaINAeOkEmiZEAjnhB-ncN31Lvy4Lo1LxiyCqKH9QwPOpa6ukK0WrYXWwiTi2VRAaxSjm-xgbGiIArmA__&amp;Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ
  
      HTTP_TRANSACTION_SEND_REQUEST_HEADERS
      --&gt; GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437076916&amp;Signature=WBDGSQXer-zAREYgiD1~DA8pUaNUBha4WrUFt-WI5Soh4Z-5ayw35UocOG7DuC9FOnAQAeU5Nvp8hKdofDB--ic4aMH0e~LmHaJ38GtP-lHnyyfQDpjJOEmGM2GY3sB0KG7qa8~eTXX9jKDJTCG9Hkf0EpievuWwiXEKGYaSbe0tkR4CLyhND3sIDJbFGCQQZ7NmhMB-3vOsqDKYKKz9SebuiqO0qbL8SvqBkMEiufXCF2MriR4hVDEjFQssE3ysBbhiMlkaINAeOkEmiZEAjnhB-ncN31Lvy4Lo1LxiyCqKH9QwPOpa6ukK0WrYXWwiTi2VRAaxSjm-xgbGiIArmA__&amp;Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ HTTP/1.1
          Host: gbbrsh.cloudfront.net
          Origin: https://qa-app.example.com
          User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
          Referer: https://qa-app.example.com/media/photos/
      HTTP_TRANSACTION_READ_RESPONSE_HEADERS
      --&gt; HTTP/1.1 200 OK
          Access-Control-Allow-Origin: https://qa-app.example.com
          Access-Control-Allow-Methods: GET
          Access-Control-Max-Age: 3000
          Access-Control-Allow-Credentials: true
          Vary: Origin
  </code></pre>