CODEWITHSUNDEEP
ajaxhttpcookieshttps
NeXuS
NeXuS

Reputation: 1797

HTTP Cookies and Ajax requests over HTTPS

I know this has been asked before in various forms, but I can't seem to get around the problem. I have tried using both jQuery and the native JS API to make the Ajax requests.

My situation is the following (see attached diagram):

  1. Browser makes HTTP request
  2. Server responds and sets persistent Cookie
  3. Browser makes HTTP Ajax request, Cookie is there alright
  4. Server responds as expected, updates Cookie
  5. Browser makes HTTPS Ajax request, Cookie is not there anymore (?!)
  6. Server gives "default" response, since there is no Cookie (unintended behaviour)

Before anybody starts a lecture on cross-domain requests let me state a couple of things:

So, why, why, why doesn't the browser pass on the cookie when making the HTTPS Ajax call? Any ideas? I am about to lose my mind...

     +-----------+ HTTP Request     +-----------+
     |Browser    |+---------------->|Server     |
     +-----------+                  +-----------+

                   HTTP Response
                  <----------------+
                   Set-cookie

                   Ajax HTTP Req.
                  +---------------->
                   Cookie (OK)

                   HTTP Response
                  <----------------+
                   Set-cookie (OK)

                   Ajax HTTPS Req.
                  +---------------->
                   No Cookie (!!!)

Upvotes: 47

Views: 37249

Answers (2)

Jeuk Shin
Jeuk Shin

Reputation: 85

Document.cookie and Ajax Request does not share the cookie. Otherwise, ajax can't access the cookies from document.cookie or the response headers. They can only be controlled by the remote domain.

If you first get response including cookie from server by ajax, Since that you can request ajax communication with cookie to server.

For this case, you write such as below code (jQuery)

 $.ajax({
      xhrFields : {
           withCredentials : true
      }
 });

See this article and demo

Upvotes: 0

NeXuS
NeXuS

Reputation: 1797

Ok, found the solution to the cookie problem.

See XHR specs, jQuery docs and StackOverflow.

The solution to have the cookies sent when switching protocol and/or subdomain is to set the withCredentials property to true.

E.g. (using jQuery)

 $.ajax( {
   /* Setup the call */
   xhrFields: {
     withCredentials: true
   }
 });

Upvotes: 80

Related Questions