1

I'm trying to build a login site on domain "example.com" that sends a Ajax request to the domain "other_domain.com" and if the credentials are ok this request sends back a session cookie. After that I want to redirect to the "other_domain.com" site and want to be logged in.

I have a solution that works on IE11, Edge, Chrome but not on Firefox because Firefox does not set the returned cookie when I redirect to the "other_domain.com" site.

This is the ajax request code:

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('POST', 'https://other_domain.com/login', true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.onreadystatechange = function () {
    if (this.status == 200 && this.readyState == 4) {

        window.location.replace("https://other_domain.com/app");

    }
};
xhr.send(JSON.stringify(payload));

I can see on every browser the OPTIONS request succeeding and also the AJAX post return 200 OK on every browser if the credentials are correct.

The returned cookie has following values:

CreationTime: "Fri, 28 Sep 20018 12:48:49 GMT"
Domain: "other_domain.com"
Expires: "Session"
HostOnly: true
HttpOnly: true
LastAccessed: "Fri, 28 Sep 20018 12:48:49 GMT"
Path: "/"
Secure: true
sameSite: "Lax"

Additional info after flagged as duplicate:

I can see in the developer console that on the OPTIONS and the POST request from the code above the following headers are returned:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://example.com

I can see the Set-Cookie header with the correct value in the response in Firefox too but the cookie is not set after the redirect to other_domain.com. Also my Firefox is set to "Accept third party cookies and site data" - "always"

5

1 Answer 1

2

I had the same issue. Look at the Set_Cookie, does it have the SameSite=lax attribute. If so, set that property to None when setting the cookie on the server. In .NET when creating a cookie, you have that option, lax, strict, or none.

https://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.samesite?view=netframework-4.7.2

1
  • Thanks for your answer. In the meantime I refactored my solution that it don't need CORS cookies. My cookie had samesSite set to lax so maybe your solution works - but I cannot test. I dont' know if I should accept your answer as i cannot check it right now.
    – mibiio
    Nov 12, 2018 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.