Question

Due to cross domain issues, I decided to try a new workaround for detecting sessions between 2 of my domains. I assumed this process would work as I wasn’t trying to set any cookies, and it works fine in chrome and firefox, but not in IE9.

I have stepped through in debug mode and the aspx page I request has no access to it’s own Request.Cookies, whereas it does when I use chrome.

The process is:

On domain1, (an asp.net mvc application) the user logs in. As part of that login process, a cookie is set on that domain. If I then hit a test page on this server, I can see the cookie has been set.

On domain2 (an asp.net webforms app), I make a jQuery.ajax request to that test page on domain1, which is meant to check for the cookie and return an encrypted string.

When stepping through during this request to domain2 when called via ajax I can see the request.cookies collection is not populated. Frustratingly, User.Identity.IsAuthenticated is true, but I can’t get access to the cookie I set.

Is this just another example of the whole cross domain security in action? To me it seems even making the ajax call using jsonp and all the other various hheaders etc, isn’t going to help in this situation as it appears to be something more than that?

Answer 1

It seems that you’re correct in your assumption. JQuery will by default not send cookies if its connected to a domain that is not the same as the domain the page is on.

You can try using the xhrFields from the JQuery API to perform the cross domain call.

$.ajax({
url: a_cross_domain_url,
xhrFields: {
   withCredentials: true
}
});

http://api.jquery.com/jQuery.ajax/

Hope that helps!