Internet Explorer Cross Domain: Not Sending Preflight

I've found several similar threads. However, none have yet seemed to work. Problem In our current ecosystem we've got three servers for our http-apis. Two for test and one for pro

Solution 1:

I was able to identify the problem using openssl. By running $ openssl s_client -connect <url/domain>:443 -state I identified an error with ssl.

Api 1 and 2 showed the following in the result from openssl:

SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A

On api 3(the failing api-server) the result showed two additional operations:

SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server certificate request A //This
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client certificate A //This
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A 

Yet I have not resolved this issue on the server. In the mean time I'm using an xdomain "hack"(https://github.com/jpillora/xdomain). It's really easy to setup and works fine.

Solution 2:

To add more details of the root cause and save anyone else looking into this many hours / days.

In my instance IE 11 was following the proper spec and not sending the client certificate when making the CORS Preflight request. Can read more about that here

This part of the spec is ignored in Chrome and other browsers and they DO send the client certificate.

In my instance we were using Pivotal Cloud Foundry and had to make a config change to ensure the connection isnt just rejected.

To easily validate if this is your problem download and install fiddler, configure it to support HTTPs and test your broken CORS again, Mine worked with Fiddler but didnt when connecting directly to the remote server.