Search code examples
ajaxhttpcookiessetcookie

Set-Cookie (from AJAX) header not setting cookie in browser

I have a single page application that's using a web API. When a user logs in, I would want the server to set a cookie for further identification.

AJAX requests are obviously HTTP, only with a small identifying header. For as far as I know, the browser's agent should not differentiate between XMLHttpRequest and normal requests. Especially since I'm using a relatively old version of firefox.

App URL: http://sub.domain.com/app API Request: http://sub.domain.com/service/method

The domain and subdomain are exactly the same. There's no attempt to change other domains cookies.

enter image description here

As you can see the cookie is recognized by the browser's request parser. Even after digging all over SO and Google, I haven't found one logical explanation to why this isn't setting the cookie.

Tried a bunch of different Set-Cookie arguments combinations. I figured the most stable syntax is key=value; expires=date; domain=.domain.com and that's what I use in the example above.

P.S. I am using actual domain and subdomain, NOT localhost. Using a relatively old and stable version of Firefox.

Solution

  • I think you issue is quite well explained here

    How does a browser handle cookie with no path and no domain

    For Set-Cookie without path attribute, RFC6265 states that:

    If the server omits the Path attribute, the user agent will use the "directory" of the request-uri's path component as the default value.

    So from your server you need to set path=/ as well to make sure cookie is accessible to everyone

    Edit-1

    Also make sure that your webpage and API both run on the same protocol. Because if the cookie is marked secured then the same cannot be read by an http url