在RestAngular请求中发送Cookie

Question

I got a Restangular.getAll function,

when i call it the cookies are not included in the API request, unlike the HTML requests who gots.

if I force a:

Restangular.setDefaultHeaders({ Cookie: function() { return "foo " + $cookies.get('foo'); } })

The error is:

Refused to set unsafe header "Cookie"

If I add to app.config:

RestangularProvider.setDefaultHttpFields({
    withCredentials: true
});

The error is:

XMLHttpRequest cannot load [*link*] A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.
 Origin [*host*] is therefore not allowed access. 
The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute.

Please note that host and link are the abbreviations for page link and host link.

EDIT: My CORSFilter in Spring:

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CORSFilter implements Filter {

    public CORSFilter() {
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization, content-type");

        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, res);
        }
    }

    @Override
    public void init(FilterConfig filterConfig) {
    }

    @Override
    public void destroy() {
    }

}

Answer 1

Your server has to return a particular content for Access-Control-Allow-Origin: You could give your webapp host URL there, or dynamically copy the origin information (for development purposes).

NOTE: its a server side fix