12

I'm using credentials: 'include' and mode: 'cors' on the client. On the server I see access-control-allow-credentials: true and access-control-allow-origin: https://dev.com:9443 headers. I don't see my cookie header though and I can't seem to find why it isn't sending. Let me know if I can provide any further details.

Fetch request

fetch(url, {
  method: 'get',
  credentials: 'include',
  mode: 'cors',
  headers: {
    'Content-Type': 'application/json'
  }
});

Options Request Headers

:authority: prod.fakedomain.com
:method: OPTIONS
:path: /Search
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9,fr;q=0.8,la;q=0.7
access-control-request-headers: content-type
access-control-request-method: GET
cache-control: no-cache
dnt: 1
origin: https://dev.com:9443
pragma: no-cache
referer: https://dev.com:9443/
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Options Response Headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,POST
access-control-allow-origin: https://dev.com:9443
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length: 0
date: Mon, 04 Feb 2019 03:45:06 GMT
status: 200
vary: Origin
x-application-context: application:8080

Get Request Headers

:authority: prod.fakedomain.com
:method: GET
:path: /Search
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9,fr;q=0.8,la;q=0.7
cache-control: no-cache
content-type: application/json
dnt: 1
origin: https://dev.com:9443
pragma: no-cache
referer: https://dev.com:9443/
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Get Response Headers

access-control-allow-credentials: true
access-control-allow-origin: https://dev.com:9443
content-encoding: gzip
content-type: application/json;charset=UTF-8
date: Mon, 04 Feb 2019 03:45:07 GMT
status: 200
vary: Origin,Accept-Encoding
x-application-context: application:8080
6
  • it looks like your server don't send back cookies - how do you check that server send cookies? Feb 4, 2019 at 3:57
  • It's not that the server should be sending me cookies. I want to send the server the client's cookies. The server wants to looks at the client's cookies and send a personalized response based on them. Currently it doesn't see the client cookies and just sends a generic non-personalized response back. Feb 4, 2019 at 4:06
  • 3
    The information in the question seems to indicate your browser doesn’t actually have a cookie set yet in its cookie store for the prod.fakedomain.com domain. The only cookies your browser will send back to prod.fakedomain.com are the cookies for that domain which have already been set in your browser’s cookie store by some previous response from prod.fakedomain.com which included a Set-Cookie response header. And as @KamilKiełczewski indicated, that server doesn’t seem to be sending back any Set-Cookie header, so it seems like you’re never getting cookies set in the browser to begin with
    – sideshowbarker
    Feb 4, 2019 at 4:27
  • @sideshowbarker thanks! So I have cookies set for dev.com but not prod.fakedomain.com. I want the server(prod.fakedomain.com) to see my dev.com cookies. Will those not be sent if there are not the prod.fakedomain.com domain? Feb 4, 2019 at 4:30
  • 1
    @anthony-dandrea if cookies from dev.com are NOT httpOnly then you can try to copy cookies (read and write) by JS Feb 4, 2019 at 4:33

4 Answers 4

10

I finally find out that problem just browser not allow two not same domain share any cookie(except for the same second level domain), it's beyond credentials: include can do, after 2 hours trying... I find out credentials: include just meaning u can send cookie but it doesn't meaning you can send cookie with two different domain..

Whatever you do, change browser setting、set cookie's SameSite any way, just can't do that...

So that is my conclusion,hope u get it...

2
  • 1
    Sadly, I believe this is true nowadays. There are old links/resources (including the MDN fetch documentation) pointing to using a combination of SameSite=None + Allow Credentials header + fetch 'include' option. None seems to be working
    – Ladmerc
    Nov 22, 2021 at 1:23
  • 1
    Have you got a source for what you claim here?
    – Sid
    Nov 5, 2023 at 5:00
6

I was able to resolve this issue by going into my Safari privacy settings and unchecking Prevent cross-site tracking

enter image description here

1
  • 4
    wow this worked! How to do the same from chrome?
    – D0m3
    Feb 16, 2021 at 15:15
2

As sideshowbarker mention in his comment, the browser don't set te cookie for domain prod.fakedomain.com and its look like that server don't set cookie too. So if you set cookies for dev.com and they are not httpOnly then you can try to copy them to prod.fakedomain.com (by read and write it by JS).

If you want to store sensitive data in the cookies (e.g. JWT token), read about XSS/XST attacks and consider the possibility of using the HttpOnly flag.

2

I've tried for days then come into conclusion:

cedentials: 'include'

and

xhrFields: { withCredentials: true}

Only works on same domain with different port, if we want to make request to another domain we have to manually add credentials (token etc..) to the request header

1
  • Have you got a source saying such?
    – Sid
    Nov 5, 2023 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.