Browsers not sending back cookies when using CORS XHR
cors, express, javascript, node.js
Solution
I don't really know anything about this other than what I've read, but according to the MDN docs there's a "withCredentials" property on the XHR object, and that needs to be set:
xhr.withCredentials = true;
By default, it's `false`. Without that flag being set, cookies are not transmitted and cookie headers in the response are ignored.
edit — I swear I read your question a couple times, but I totally missed your mention of the flag . Sorry. However, so as this isn't a total waste, I'll also mention that your server needs to be setting the "Access-Control-Allow-Credentials" flag to `true` in the response header, and "Access-Control-Allow-Origin" set to your current protocol + host + port.
Problem
edit - looking at the cookies using Chrome web inspector, it seems like no matter what the expire value of the cookie is, the browser sets it as a session cookie and deletes it per request. I am building a CORS example for a class I'm teaching, using Node.js and Express. However, although cookies are being set from the server, they are not being sent back to the server on following requests. This pretty much means I can't use any trivial session manager. Any idea what I'm missing here? Why doesn't the browser send cookies set by a domain back to that domain? Shouldn't this be happening automatically? edit - some code examples: setting up the XHR request: ``` var xhr = new XMLHttpRequest(); xhr.open(method, url, true); xhr.widthCredentials = true; xhr.onreadystatechange = function(res){ if (xhr.readyState == 4){ cb(res,xhr); } }; xhr.setRequestHeader("Content-Type",'application/json'); xhr.setRequestHeader('Accept','application/json'); xhr.send(JSON.encode({param:some_param})); ``` server: ``` function allowCrossDomain(req,res,next) { res.header('Access-Control-Allow-Credentials', true); res.header('Access-Control-Allow-Origin', req.headers.origin); res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS'); res.header('Access-Control-Allow-Headers', 'Content-Type,Accept,X-Requested-With'); if (req.method!='OPTIONS') return next(); res.send(204); } //while configuring express app.use(allowCrossDomain) ``` It is also worth mentioning that I have tried various `npm` middlewares that do the same thing with no observable difference As for scenario: - Make a CORS request using XHR - Server sets a cookie, that is being successfuly sent back to the client (express session cookie) - The next XHR request will not send that cookie back to the server, so express cannot identify the user, and so creates a new session cookie and so forth.