edit - looking at the cookies using Chrome web inspector, it seems like no matter what the expire value of the cookie is, the browser sets it as a session cookie and deletes it per request.
I am building a CORS example for a class I'm teaching, using Node.js and Express.
However, although cookies are being set from the server, they are not being sent back to the server on following requests. This pretty much means I can't use any trivial session manager.
Any idea what I'm missing here? Why doesn't the browser send cookies set by a domain back to that domain? Shouldn't this be happening automatically?
edit - some code examples: setting up the XHR request:
var xhr = new XMLHttpRequest();
xhr.open(method, url, true);
xhr.widthCredentials = true;
xhr.onreadystatechange = function(res){
if (xhr.readyState == 4){
cb(res,xhr);
}
};
xhr.setRequestHeader("Content-Type",'application/json');
xhr.setRequestHeader('Accept','application/json');
xhr.send(JSON.encode({param:some_param}));
server:
function allowCrossDomain(req,res,next) {
res.header('Access-Control-Allow-Credentials', true);
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type,Accept,X-Requested-With');
if (req.method!='OPTIONS') return next();
res.send(204);
}
//while configuring express
app.use(allowCrossDomain)
It is also worth mentioning that I have tried various npm
middlewares that do the same thing with no observable difference
As for scenario:
- Make a CORS request using XHR
- Server sets a cookie, that is being successfuly sent back to the client (express session cookie)
- The next XHR request will not send that cookie back to the server, so express cannot identify the user, and so creates a new session cookie and so forth.
true