var cookie = new CookieHeaderValue("access_token", token);
                cookie.Expires = DateTimeOffset.Now.AddDays(1);
                cookie.Domain = Request.RequestUri.Host;
                cookie.Path = "/";
                //cookie.Secure = false;
                //cookie.HttpOnly = false;

                response.Headers.AddCookies(new CookieHeaderValue[] { cookie });

<httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Headers" value="Content-Type, *" />
    <add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS,PUT,DELETE" />
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Credentials" value="true" />
  </customHeaders>
</httpProtocol>

var xhr = new XMLHttpRequest();
                var data = { UserName: "user", Password: "password" };

                xhr.open("POST", "TheURL", true);
                xhr.setRequestHeader("Content-type", "application/json");
                xhr.withCredentials = true;
                xhr.onreadystatechange = function () {
                    if (xhr.readyState === 4) {
                        if (xhr.status === 200) {
                            //Success
                        }
                        else {
                            //Failure
                        }
                    }
                }
                xhr.send(JSON.stringify(data));
             }

var xhr = new XMLHttpRequest();

        xhr.open("GET", "TheURL", true);
        xhr.setRequestHeader("Content-type", "application/json");
        xhr.withCredentials = true;
        xhr.onreadystatechange = function () {
            if (xhr.readyState == 4) {
                //Do stuff with the data
            }
            else {
               //Deal with the error
            }
        }

        xhr.send(); //No Cookie is sent.