客户端和服务器端 cookie

Question

I created a cookie on the client's browser using "document.cookie" (localhost:8000). Then I used XMLHttpRequest() to call a same-origin server (localhost:8000). I COULD use PHP's $_COOKIE on the server to get the cookie I created on the client.

When I did the same using a cross-origin server (localhost:8080), I could NOT get the cookie even though I set 'withCredentials' property on the XMLHttpRequest object to 'true' and used the following on the server side:

header("Access-Control-Allow-Origin: http://localhost:8000"); header("Access-Control-Allow-Credentials: true");

That means the local cookies are visible only on a same-origin server but not on a cross-origin server. Is my understanding correct, or I am doing something wrong?

Thank you Albert

Answer 1

When I learnt about Fetch which is newer than XMLHttpRequest, I thought that it would allow me to send the local cookie created on the browser to the cross-origin server, but to my surprise, I found the same result. The documentation says I can. Please refer to the section: Sending a request with credentials included in https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch