Search code examples
node.jssessioncookiescross-domainsession-cookies

CORS cookies not setting by browser , cookies are present in response

I am sending http request to API endpoint of node.js server, this response is containing cookies and showing in mozilla debugger. I am sending this request through localhost.org or by my virtual host e.g myapp.example.com. I tried AJAX XMLHTTPRequest and angular http as well also add xhrFields: {withCredentials: true} for AJAX credentials: 'include' for fetch, etc.

But cookies are not being set by browser, I am trying this for 2 days but this problem is not yet resolved.

this is util function which send ajax request

function sendServerRequest(url,method,data) {
return new Promise(function ( resolve ) {
    resolve($.ajax({
        url,
        method: method || 'GET',
        data,
        xhrFields: {withCredentials: true},
        crossDomain: true,
        success: function ( data ) {
            return data
        },
        error: function ( err ) {
            try {
                let responseStatus = err.responseJSON
                if ( responseStatus.status === sessionExpires ) {
                    sessionExpireCall(responseStatus.message)
                }
            } catch ( e ) {
                console.log('Failed to get response');
            }
        }
    }));
 })
}

Response Raw

HTTP/1.1 200 OK
X-RateLimit-Limit: 13000
X-RateLimit-Remaining: 12996
Date: 2019-06-26 06:17:56
X-RateLimit-Reset: 1561533343
X-DNS-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: http://192.168.10.3
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type,             
Authorization
Access-Control-Allow-Credentials: true
set-cookie: true
set-cookie: driverId=c81e728d9d4c2f636f067f89cc14862c; Max-Age=3600;       
Domain=192.168.10.3; Path=/; Expires=Wed, 26 Jun 2019 07:17:56 GMT
set-cookie: driverName=kamran; Max-Age=3600; Domain=192.168.10.3; Path=/; 
Expires=Wed, 26 Jun 2019 07:17:56 GMT
set-cookie: connect.sid=s%3AX- syECgzpFEZhh4d5B_xfStUoYPrO3p1.%2FPj%2BMo7UnaZto6OGoP%2BOjdKvrJ%2F3Fm%2Bn1BJ%2FXU7Qdh8; Domain=192.168.10.3; Path=/; Expires=Wed, 26 Jun 2019 07:17:56 GMT; HttpOnly
Content-Type: application/json; charset=utf-8
Content-Length: 34
ETag: W/"22-tpsDmOyD3m/F84/JvyRCwDCbeY8"
Connection: keep-alive

{"detail":"verified","status":200}

Request Raw

GET http://localhost:3000/driverboard/verifycode? 
mobile=923002222222&vcode=2609 HTTP/1.1
Host: localhost:3000
Connection: keep-alive
Accept: */*
Origin: http://192.168.10.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
Referer: http://192.168.10.3/capptin-driverboard/verification.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: true

http request snapshot

Solution

  • CORS is not about cookies, CORS about HTTP headers. It allows making cross-domain requests(from one domain to another. For example from myapp.example.com to google.com). Cookies only send to the same domain, for example from myapp.example.com you can send cookies to the same domain .example.com

    Docs here https://developer.mozilla.org/ru/docs/Web/HTTP/CORS