title: CORS GET returns an empty response body in Firefox
body: <p>From a RESTful Backbone application, I'm doing CORS requests from <code>mydomain.com</code> to <code>myExtdomain.com</code>.</p>
  
  <p>I <em>did</em> set up CORS on my <code>myExtdomain.com</code> server, I'm responding to <code>OPTIONS</code> verb (any URL) with:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
  Access-Control-Allow-Headers: Content-Type
  
  Status Code: HTTP/1.1 204 No Content
  </code></pre>
  
  <p>And to my API calls on <code>myExtdomain.com</code> with:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Content-Type: application/json
  
  Status Code: HTTP/1.1 200 OK
  </code></pre>
  
  <p>I even desperately tried to respond to <em>all</em> my HTTP requests on <code>myExtdomain.com</code> with everything:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
  Access-Control-Allow-Headers: Content-Type
  Content-Type: application/json
  
  Status Code: HTTP/1.1 200 OK
  </code></pre>
  
  <h2>The problem</h2>
  
  <ul>
  <li>Everything works fine in Chrome</li>
  <li>In Firefox, my <code>PUT</code> requests work, but my <code>GET</code> requests "kinda fail"...</li>
  </ul>
  
  <h2>"Kinda fail" definition</h2>
  
  <ul>
  <li>The returned HTTP status code is <code>200 OK</code></li>
  <li>But the response is empty (No Response Body/Size 0 KB).. It supposed to be some <code>JSON</code>.</li>
  <li>But, for some reason, every once in 100 times, one <code>GET</code> request works</li>
  </ul>
  
  <h2>The boring details a.k.a "The Headers"</h2>
  
  <p>Responding to <code>OPTIONS</code> verb:</p>
  
  <pre><code>REQUEST HEADERS
  -----------------
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
  Origin: http://mydomain.com
  Host:   www.myExtdomain.com
  Connection: keep-alive
  Access-Control-Request-Method:  PUT
  Access-Control-Request-Headers: content-type
  Accept-Language:    en-US,en;q=0.5
  Accept-Encoding:    gzip, deflate
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  RESPONSE HEADERS
  -----------------
  X-Powered-By:   ASP.NET
  Server: Microsoft-IIS/7.0
  Date:   Fri, 15 Nov 2013 07:01:57 GMT
  Content-Type:   text/html
  Access-Control-Allow-Origin:    *
  Access-Control-Allow-Methods:   POST, GET, OPTIONS, PUT, DELETE
  Access-Control-Allow-Headers:   Content-Type
  </code></pre>
  
  <p>A <code>PUT</code> request:</p>
  
  <pre><code>REQUEST HEADERS
  ----------------
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
  Referer:    http://mydomain.com/account
  Origin: http://mydomain.com
  Host:   www.myExtdomain.com
  Content-Type:   application/json; charset=UTF-8
  Content-Length: 36
  Connection: keep-alive
  Accept-Language:    en-US,en;q=0.5
  Accept-Encoding:    gzip, deflate
  Accept: application/json, text/javascript, */*; q=0.01
  
  RESPONSE HEADERS
  ----------------
  X-Powered-By:   ASP.NET
  Server: Microsoft-IIS/7.0
  Date:   Fri, 15 Nov 2013 07:01:57 GMT
  Content-Type:   application/json
  Content-Length: 0
  Access-Control-Allow-Origin:    *
  
  BODY RESPONSE
  --------------
  _Some_Json_Here_
  </code></pre>
  
  <p>The <em>magic</em> <code>GET</code> request:</p>
  
  <pre><code>REQUEST HEADERS
  ----------------
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
  Referer:    http://mydomain.com/somepage
  Origin: http://mydomain.com
  Host:   www.myExtdomain.com
  Connection: keep-alive
  Accept-Language:    en-US,en;q=0.5
  Accept-Encoding:    gzip, deflate
  Accept: application/json, text/javascript, */*; q=0.01
  
  RESPONSE HEADERS
  ----------------
  Server: Microsoft-IIS/7.0
  Last-Modified:  Fri, 15 Nov 2013 06:58:18 GMT
  Date:   Fri, 15 Nov 2013 07:01:57 GMT
  Content-Type:   application/json
  Content-Length: 4041
  Connection: keep-alive
  
  RESPONSE BODY
  --------------
  Empty (0KB), it's supposed to be some JSON, that *SOMETIMES* (1/100) I get.. Magic.
  </code></pre>
  
  <h2>Closing thoughts</h2>
  
  <ul>
  <li>As you can see the Response Headers of the magic <code>GET</code> request do not even include the CORS Headers I do set on <code>myExtdomain.com</code></li>
  <li>The <code>PUT</code> request on the other hand does include them..</li>
  <li>Again, everything works just fine in Chrome, all the Response Headers are present, I get my <code>JSON</code> as expected, etc..</li>
  <li>I spent a rather long time <a href="https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS">studying</a> <a href="http://www.html5rocks.com/en/tutorials/cors/">CORS</a> (was not enough apparently), trying to break down what's needed/not needed and not copy/pasting random code</li>
  <li><code>JSONP</code> for <code>GET</code> requests is <em>not</em> an alternative for me</li>
  <li>All my requests (any verb) are made from non-secure pages (<em>not</em> from <code>https://</code>)</li>
  <li>I'm desperate..</li>
  </ul>