I have a weird problem, I have got CORS working without cookies, and am now adding cookie support as my webservice uses cookies as part of its authentication mechanism for certain routes.
Now originally when I set the xhr.withCredentials = true it would receive and accept the cookie, but then I realised that the cookie’s domain was “localhost” and subsequent calls to the service would not send the cookie over. This is still a partial unknown as to why it wont send the cookie back over, but it is presumed that it is because the actual service resides upon “localhost:1893” not “localhost” like the domain says.
So… I changed the domain in the service to correctly reflect the port number, so it was then “localhost:1893”. However when the CORS request happens now, it receives the cookie in the response (you can see it in the firebug response), however the cookie is gray and doesn’t appear in the actual cookies section of firebug.
Could anyone shed any light on this?
- Using Firefox 5
- Using jquery 1.6.1
- XHR has withCredentials set correctly
- Server returns correct CORS headers
Although CORS allows cookies to be sent/received between the server (by setting withCredentials to true), the cross-domain restrictions on the cookie still apply. For example, you can’t access the cookie in JavaScript using document.cookie. I imagine Firebug is following the same rules.