8

I am making a simple login using Node.js with CORS and Angular.js.

That is --- client.example.com is making a POST too api.example.com/login where on success a session cookie is returned too client.example.com and can gain access too a GET service like api.example.com/secret protected by the session cookie.

Making GET requests that aren't protected by a session cookie isn't a problem.

Ultimately, the goal here is too authenticate a client side app to a REST api using CORS with a local stradegy --- i.e. username & password --- even if the convention above isnt possible.

I can not find a working implimentation to learn from anywhere --- point me in the right direction?

Bonus: Show a working example.

Community
  • 1
  • 1
Dan Kanze
  • 18,485
  • 28
  • 81
  • 134
  • This is only possible if you set the domain of your cookie to be .example.com. You cannot set a cookie for client.example.com from api.example.com: http://stackoverflow.com/questions/1062963/how-do-browser-cookie-domains-work – alexwen Apr 23 '13 at 01:12
  • @alexwen What if I wanted to accept from any domain, like --- `client.example1.com` & `client.example2.com`. The goal here is too authenticate a client side app too a REST api using CORS with a local stradegy --- i.e. `username` & `password`. – Dan Kanze Apr 23 '13 at 01:15

1 Answers1

2

Your problem is very simple, browsers do not allow sending cookies set in one domain to be sent to a different domain.
This is for security. If your session cookie was accessible from any domain, then any site could perform csrf (by definition, what you want is to do csrf - use the session from one site in a different site).

There are ways around it, though you should be careful when applying them.

  • Easiest way is by using Jsonp to login and make cross-domain requests, jsonp basically breaks the cookies cross-domain policies.

  • You can embed an iFrame in client.example.com page that sits in api.example.com, the parent and the iFrame can communicate using post message.

Both ways are open to csrf requests (by their very nature), so you should be extra careful in what information you allow client.example.com to access.

Alon Bar David
  • 1,757
  • 14
  • 15