Firefox: Cross-domain requests with credentials return empty

Answer 1

This is from the bottom of the MDC section you linked to:

Important note: when responding to a credentialed request, server must specify a domain, and cannot use wild carding. The above example would fail if the header was wildcarded as: Access-Control-Allow-Origin: *.

I bet you missed this, it's hidden under a couple big example code blocks.