Question

Just wondering if it’s possible to use an XMLHTTPReq to login to a website, and store the cookie. Specifically I’m after the PHPSessionID from the website I am logging into.

I then want to pass this cookie into another request to submit a form.

Any ideas of how to do this?

Cheers,
Nick

Answer 1

You will be able to get your own site’s cookies from document.cookie. In the AJAX callback, use a library to parse the value and read the cookie you’re looking for.

Of course, if the server sets the cookie HttpOnly (which it should be doing), it won’t be available in document.cookie.

At this pont, you need to reevaluate what you’re doing:

• If the form points to your website, your server script would have access to the cookie anyway.
• If you’re sending the user’s session ID to another domain, why? This is a huge red flag that screams security problem.

---

If you’re logging in to another site, then no – the same-origin policy prevents you from accessing another site’s cookies.

---

Edit: Since this is for your own use, you can do this in a way you’re not limited by the browser’s origin restrictions. Some thoughts:

• You could make a Chrome extension. Extensions aren’t subject to origin restrictions, and the development model and API is pretty much the same as what you’d do on a regular web page.
• You could use Node, which has no restrictions. You’d be able to invoke your script from the command line, but the API is going to be slightly different that what you’d use in a web page.
• Use your language and framework of choice to POST to the login page, get the Set-Cookie header in the response, and use it to send a Cookie header in another POST to the form target.