在跨域服务器的GET请求中包含cookie

Question

I'm trying to send an XHR via pure Javascript to a cross-domain server, while including the cookie values that I've generated on my domain.

I am also working on an embedded system that does not have a same-origin policy enabled.

I've attempted a few different configurations that I've found on SO but none have worked so far.

For example, here is my GET request:

Remote Address: XXX.XXX.XXX.XXX:80  
Request URL: http://someotherdomain.com/api?param1=value&param2=value2  
Request Method: GET

Accept:*/*  
Accept-Encoding:gzip,deflate,sdch  
Accept-Language:en-US,en;q=0.8  
Connection:keep-alive  
Cookie:OTHERSITESCOOKIE=somevalue  
Host:someotherdomain.com  
Referer:http://myexample.com/mypage 

And here are some of the response headers that I can see:

Access-Control-Allow-Credentials:true  
Access-Control-Allow-Origin:*  
Content-Length:79  
Content-Type:application/json  

So the problem for me is that the remote server is expecting certain values in the "Cookie" header, but I cannot set it directly in the request. I tried setting the cookie for my domain but it was not sent with the request, and I cannot create a cookie for the remote domain.

Does anyone know what I'm missing to be able to include my own domain's cookies in the request? Thanks!

Answer 1

You can not set the Cookie header for an ajax request, you will get an Illegal warning if you try. One option is to set a different header (ie, Ajax-Cookie) and then have them parse it on the server side.

Pure JavaScript:

xmlhttp.setRequestHeader( 'Ajax-Cookie', document.cookie );

jquery equivalent:

$.ajax({
        url: cross-domain-url,
        headers: { 'Ajax-Cookie' : document.cookie }
        ...
});

If you are using php you can use http_parse_cookie to get the cookies values.

$_AJAX_COOKIES = http_parse_cookie( $_SERVER[ 'HTTP_AJAX_COOKIE' ] )[ 'cookies' ];

EDIT:

Here is a list of headers you can not set: accept-charset, accept-encoding, access-control-request-headers, access-control-request-method, connection, content-length, content-transfer-encoding, cookie, cookie2, date, expect, host, keep-alive, origin, referer, te, trailer, transfer-encoding, upgrade, via