Home/ Questions/Q 8147759
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T14:27:19+00:00

I’ve built a RESTful service that serves XML + JSON to Android clients and

  • 0

I’ve built a RESTful service that serves XML + JSON to Android clients and a browser client. Currently, my REST service uses cookie based authentication. Everything works together within Same Origin Policy since the browser client pages are served from the same web server that serves the REST service.

I’d like to separate my browser app and serve its pages from a different web server than the REST services. I can use Cross Origin Resource Sharing to continue making XmlHttpRequest calls from the browser to the REST services but I can’t figure out authentication.

  1. I send an XmlHttpRequest off to the authentication service
  2. The REST server sets a cookie in the response
  3. When the browser receives the successful request, it moves the app to the next page
  4. The next page does not maintain the cookie set on the log on page so all XmlHttpRequest calls to the REST service fail with 401

What’s the best way to tackle this? If cookie authentication is a no go, what should I use for this situation?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    My suggestion would be to run an Apache or similar web server in front of both servers and use the proxy module. That way all the calls are to the same host so the cookies keep. This has worked for me in a number of projects including ones with cookie based authentication.

    • 0