XmlHttpRequest status 0 instead of 401 in IE 10

Question

I have hit a wall with this issue. I guess it is some kind of IE bug but I want to be sure.

So the question is. Why does IE10 XmlHttpRequest.status returns 0 instead of 401?

var xmlhttp=new XMLHttpRequest();

xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4)
    {
      document.getElementById("rescode").innerHTML="Request completed with status: "+xmlhttp.status;
    }
  }
xmlhttp.open("GET","http://hosting.gregy.cz/cors/",true);
xmlhttp.send();

See plunker here: http://plnkr.co/edit/E2lCflPDHHaQi7t79IeM?p=preview

This code fires a CORS request which always returns 401. Firefox and chrome correctly return 401 in status attribute but IE10 returns 0. This issue breaks authentication handling methods I use for my project.

Thank you

Edit:

I have modified the plunker with onload and onerror event handlers (tip from monsur's comment), but the result is still the same.

I have also made sure IE10 has no compatibility mode selected. (tip from cernunnos's comment)

Answer 1

This appears to be a bug in IE10 (https://connect.microsoft.com/IE/feedback/details/785990/ie-10-on-win8-does-not-assign-the-correct-status-to-xmlhttprequest-when-the-result-is-401).

IE10 is treating HTTP status 401 as a network error. The console shows:

SCRIPT7002: XMLHttpRequest: Network Error 0x80070005, Access is denied

According to the XMLHttpRequest Level 2 specification the status attribute should be zero if the error flag is set (for example because of a network error). However the specification also states (http://www.w3.org/TR/XMLHttpRequest2/#infrastructure-for-the-send-method) that a network error

does not include HTTP responses that indicate some type of error, such as HTTP status code 410.

I think it is clear that HTTP status 401 should not therefore be treated as a network error (as it is not in Chrome, Firefox and Safari) and that this is a bug in IE10.

Answer 2

I just ran into this problem today. After trying a few workarounds, and some Googleing, I ended up here. It turned out to just be a security level settings. Whatever security zone your website is in (Internet Options > Security) make sure you ENABLE the following setting in your zone: Miscellaneous > Access data sources across domains.