0

Here is my scenario:

I am making an ajax request from foo.com to api.bar.com. In the response, it sets some cookies using Set-Cookie header. The domain on the set-cookie header is .bar.com. I am using all steps listed here How to make XMLHttpRequest cross-domain withCredentials, HTTP Authorization (CORS)?

I am able to see and verify (using Chrome extension EditThisCookie) that cookies are being set properly for domain .bar.com.

According to my understanding, when I make an ajax request (using withCredential:true) to cdn.bar.com, , it should include the cookies that were set earlier for domain .bar.com.

These cookies do not get included in the request, I can see it in fiddler. What am I missing here?

EDIT

Cookies DO get included in the request header If I make a request to cdn.bar.com from an origin app.bar.com. The problem only appears when it's called from a different origin foo.com.

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
user3219798
  • 333
  • 6
  • 14

1 Answers1

0

The issue was with the SameSite restriction of the cookie. If I change the it from lax to No Restriction then it works fine.

user3219798
  • 333
  • 6
  • 14