无法访问 Set-cookie 响应标头和/或 cookie 请求标头

Question

I am trying to login into a platform using REST API. The platform Doc about REST API authentication say that when authenticated after posting the credential the post will return session cookie to send back on all subsequent authenticated requests. The problem is I'm using cross domain which doesn't let me access to Set-cookie header or to cookie header. I tried many things I saw on forums.

This is the actual server configuration:

Access-Control-Allow-Origin:*;Access-Control-Allow-Methods:GET, POST, OPTIONS;Access-Control-Expose-Headers:Set-Cookie;Access-Control-Allow-Headers:Set-Cookie;HttpOnly:false;

This the response headers I get after the post using this configuration:

Access-Control-Allow-Headers:Set-Cookie
Access-Control-Allow-Methods:GET, POST, OPTIONS
Access-Control-Allow-Origin:http://127.0.0.1:4482
Access-Control-Expose-Headers:Set-Cookie
Cache-Control:no-cache, no-store, private
Connection:keep-alive
Content-Length:10
Content-Type:text/plain; charset=utf-8
Date:Wed, 23 Mar 2016 08:51:02 GMT
HttpOnly:false
Server:Wisp/1.0.67.13
Set-Cookie:fanws=071b2016-2718-f680-7149-000d3ab17336-cea3f199fc0dd453;Path=/
X-Frame-Options:SAMEORIGIN

The value in Set-cookie header is not automatically set in the browser and it seem to be impossible to get using JavaScript. When I type:

console.log(headers.getAllResponseHeaders());

I don't even see the Set-Cookie in the console. All I get is this:

Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, private

I also used this configuration server side:

Access-Control-Allow-Origin:http://127.0.0.1:4482;
Access-Control-Allow-Methods:GET, POST, OPTIONS;
Access-Control-Expose-Headers:Set-Cookie;
Access-Control-Allow-Headers:Set-Cookie;
HttpOnly:false;
Access-Control-Allow-Credentials:true;

The only thing that have changed in client side is that the Set-Cookie disappeared from response headers and a Cookie header having the same value appeared in the request headers:

Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Connection:keep-alive
Content-Length:103
Content-Type:application/x-www-form-urlencoded; charset=UTF-8
Cookie:fanws=071ad3d7-a5ad-4cc0-7ff4-000d3ab17336-d81da7968d36156c
Host:********
Origin:http://127.0.0.1:4482
Referer:http://127.0.0.1:4482/Skyspark.html
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

And I still have the same problem which is I can't access to cookies sent by server.

Answer 1

The XHR API forbids direct access to cookie data .

Return all response headers, excluding headers that are a case-insensitive match for Set-Cookie or Set-Cookie2 , as a single string, with each header line separated by a U+000D CR U+000A LF pair, excluding the status line, and with each header name and header value separated by a U+003A COLON U+0020 SPACE pair.

You either need to pass the data using some other method, or just set withCredentials and let the browser handle the cookies internally.