Adding $.support.cors = true fixes the issue but changing a global setting would be evil. I tried using mw.ForeignApi, but I get

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.

in all browsers

Tagging some services people as this might require changes to Citoid headers?

In T134928#2286192, @Esanders wrote:

Adding $.support.cors = true fixes the issue but changing a global setting would be evil.

Looking at jQuery's source code, the same can be achieved by passing crossDomain: false in AJAX options (even though it is a cross-domain request).

In T134928#2286192, @Esanders wrote:

I tried using mw.ForeignApi, but I get

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.

in all browsers

I misled you when I suggested this, it won't help.

Change 289865 had a related patch set uploaded (by Esanders):
Fix IE9 cross domain request

https://gerrit.wikimedia.org/r/289865

Change 289865 merged by jenkins-bot:
Fix IE9 cross domain request

https://gerrit.wikimedia.org/r/289865