Cookie 不在跨域请求中发送

Question

I'm working on little side project on my localhost and want it to send a JSON cross-origin request to my other server that implements some REST API in PHP.

To process a request properly the server has to receive a cookie that is set when a user logs in.

When I log in to my server and manually open API URL in a browser, I can see the Cookie: header sent together with the request in F12 tools. However, when I do cross-origin request from a script on my localhost:

var xhr = new XMLHttpRequest();
xhr.open('GET', "https://devbox.my.domain/api.php", true);
xhr.setRequestHeader('Accept', 'application/json'); 
xhr.withCredentials = true;
xhr.send();

... Cookie: header is not sent and I don't see any preflight OPTION requests either when viewing Network tab in F12 tools.

I'm not showing details of how I'm handling the request on the server with Access-Control-Allow-Origin: * headers, etc because as you can see the problem occurs before, ie the server doesn't get the cookie in the first place.

The cookie has SameSite=Lax , but that doesn't change the behavior.

Is there any way to force Cookie to be sent?

Answer 1

如果要发送此 cookie 的内容，cookie 将保留在前端，则需要通过 get 调用或将其保存在标题中发送