10

Unlike simple requests (discussed above), "preflighted" requests first send an HTTP request by the OPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send.

(https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)

Due to CORS, cookies are not being sent along the preflight request. This behaviour is confirmed by that issue. https://bugs.chromium.org/p/chromium/issues/detail?id=377541

But what does happen if Set-Cookie is returned in the response? Does the browser remembers that new cookie or simply discards it?

1 Answer 1

13

Browser discards Set-Cookie in the response to OPTIONS.

(Tried Chrome, Firefox, and Opera. Set-Cookie in the response to OPTIONS is always ignored.)

1
  • 1
    I observed similar behaviour but wasn't sure whether it was down to this or something else in the page set up. Thanks! Jan 5, 2017 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.