29

edit - looking at the cookies using Chrome web inspector, it seems like no matter what the expire value of the cookie is, the browser sets it as a session cookie and deletes it per request.

I am building a CORS example for a class I'm teaching, using Node.js and Express.

However, although cookies are being set from the server, they are not being sent back to the server on following requests. This pretty much means I can't use any trivial session manager.

Any idea what I'm missing here? Why doesn't the browser send cookies set by a domain back to that domain? Shouldn't this be happening automatically?

edit - some code examples: setting up the XHR request:

var xhr = new XMLHttpRequest();

xhr.open(method, url, true);
xhr.widthCredentials = true;

xhr.onreadystatechange = function(res){
    if (xhr.readyState == 4){
        cb(res,xhr);
    }
};

xhr.setRequestHeader("Content-Type",'application/json');

xhr.setRequestHeader('Accept','application/json');

xhr.send(JSON.encode({param:some_param})); 

server:

function allowCrossDomain(req,res,next) {  
    res.header('Access-Control-Allow-Credentials', true);
    res.header('Access-Control-Allow-Origin', req.headers.origin);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
    res.header('Access-Control-Allow-Headers', 'Content-Type,Accept,X-Requested-With');

    if (req.method!='OPTIONS') return next();

    res.send(204);
}                 

//while configuring express
app.use(allowCrossDomain)

It is also worth mentioning that I have tried various npm middlewares that do the same thing with no observable difference

As for scenario:

  1. Make a CORS request using XHR
  2. Server sets a cookie, that is being successfuly sent back to the client (express session cookie)
  3. The next XHR request will not send that cookie back to the server, so express cannot identify the user, and so creates a new session cookie and so forth.
6
  • 1
    Code is worth a thousand words. :-) Show your code setting all the CORS headers, setting the cookie, etc. Jul 22, 2012 at 14:38
  • Are you using a virtual machine for your server? Jul 22, 2012 at 14:43
  • Just for clarification: you're talking about cookies set by the server in the domain to which the cross-origin calls are being made, right?
    – Pointy
    Jul 22, 2012 at 14:49
  • Also check out this stuff and in particular the part about the "omit credentials" flag, and about how a user agent can force that to always be true
    – Pointy
    Jul 22, 2012 at 14:53
  • 5
    looks like you have typo in your code.should be xhr.withCredentials = true; not xhr.widthCredentials = true;
    – Mahes
    Nov 24, 2013 at 15:50

4 Answers 4

37

I don't really know anything about this other than what I've read, but according to the MDN docs there's a "withCredentials" property on the XHR object, and that needs to be set:

xhr.withCredentials = true;

By default, it's false. Without that flag being set, cookies are not transmitted and cookie headers in the response are ignored.

edit — I swear I read your question a couple times, but I totally missed your mention of the flag . Sorry. However, so as this isn't a total waste, I'll also mention that your server needs to be setting the "Access-Control-Allow-Credentials" flag to true in the response header, and "Access-Control-Allow-Origin" set to your current protocol + host + port.

3
  • If you'd read the question: including enabling the withCredentials flag Jul 22, 2012 at 15:02
  • @FlorianMargaine oops :-) Well I'll extend the answer anyway
    – Pointy
    Jul 22, 2012 at 15:02
  • 3
    @XiroX As @Mahes spotted in the comments of the Question withCredentials is actually misspelled in your code, and that's probably the reason why you are not getting the cookies sent.
    – pauloya
    Mar 11, 2014 at 17:09
6

This happened to me before, and I can tell it's pretty stupid.

If you're using a virtual machine, you usually suspend it/resume it whenever you need it etc.

This means that the date of the virtual machine is usually some days late (or more) compared to the host, or any client you're using.

So when the server sets the cookie expire's date (usually a couple hours after current date), it is already expired on the client. Thus, the client doesn't keep it.

To update your date on your virtual machine, I suggest you just use ntpdate, or you can manually set the date to see if that's the problem:

# what's the date?
date
# You'll see if it's the problem already

# If it is, here is how to manually set it
date -set 2012-07-22 # yyyy-mm-dd
date -set 17:00:42 # hh:mm:ss
3
  • @XiroX Did you check the date on your server? Jul 23, 2012 at 7:42
  • yes - it's not a date issue - the dates sent by the server are fine Jul 24, 2012 at 6:32
  • 1
    haha something like that happened to me once. I am glad I didn't have a baseball bat handy.
    – vtortola
    Jan 15, 2014 at 14:24
6

I just had this problem, the solution in my case was add the path to the cookie, so when add the cookie you must use:

document.cookie = 'cookieName=cookieValue;path=/';

this way the browser will be able to send the cookie in the new request.

PS: You also need the xhr.withCredentials = true; if you are using cross domain request.

1
  • 2
    Can't upvote this enough, this was throwing me for a loop trying to do the exact same thing, setting a cookie via javascript, setting withCredentials = true, but until I had the path on the cookie set my browser (chrome) would NOT transmit that cookie May 28, 2019 at 17:37
2

I had a similar problem, and it turned out that the browser settings were blocking third-party cookies (Chrome > Settings > Advanced Settings > Privacy > Content Settings > Block third-party cookies and site data). Unblocking solved the problem!

1
  • 3
    This doesn't really help as you don't have control over the user's settings. Granted, in this case, because he is teaching a class he could tell his students to disable the setting, but in a real world scenario this will be of little help.
    – ximi
    Aug 8, 2013 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.