0

I'm currently using the following JavaScript to send POST data to a website of mine:

example1.com:

function buttonFunction() {
    $.post("http://example2.com/core/file.php",{username:username, password:pword, coins:coins}, function(data) {
        // Stuff
    });
}

Then within file.php on example2.com I have the following to save and read a session:

<?php
namespace Penguin;

session_start();
if(isset($_SESSION['money_maker'])) {
    echo "Cannot run.";
} else {
    $_SESSION['money_maker'] = getmypid();
    echo $_SESSION['money_maker'];
    echo "Running.";
}

header('Access-Control-Allow-Origin: http://example1.com');
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS');
header('Access-Control-Max-Age: 1000');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');

date_default_timezone_set('America/New_York');
error_reporting(0);

// REST OF THE PHP CODE

?>

As one can see, I set a session (if one has not already been set), and then if the session is already set, the script will echo "Cannot run."

However, the script never echos "Cannot run." even if I set the session on the previous AJAX run. In other words, the session is not being "saved." It always outputs "Running."

HOWEVER, in /var/lib/php5 it seems like the session files are being created, yet there are no cookies for the session in my browser. So when I try to test against $_SESSION['money_maker'] in my PHP file, it always outputs that it is NOT set. Any help?

EDIT 1:

It seems like the problem lies in the AJAX request. When I tried to run the script directly, the session was saved perfectly fine (and the cookie was created). It seems like when I try to send a POST request to the PHP file via AJAX from my different domain, the session is set (a session file is created in /var/lib/php5), but the cookie for the session is not created.

With that being the case, is there any fix?

user3681788
  • 221
  • 4
  • 15
  • One thing I immediately notice is that in your example, you state that you are making an AJAX call from example1.com, however your AJAX url is for example2.com. Are you in fact attempting to make a cross-domain AJAX request, or is that a typo? – oliakaoil Jul 23 '14 at 13:52
  • @oliakaoil Yes, I am trying to make a cross-domain AJAX request (I also have control over `example2.com`). I have referenced this a bit in my first edit. – user3681788 Jul 23 '14 at 13:53
  • Read this: http://stackoverflow.com/questions/14462423/cross-domain-post-request-is-not-sending-cookie-ajax-jquery – oliakaoil Jul 23 '14 at 13:55
  • @oliakaoil Ahh, so how can I use the `Set-Cookie` header? If I use that, I can fix this issue, correct? – user3681788 Jul 23 '14 at 13:59
  • Skimming this: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy, and this: http://stackoverflow.com/questions/3076414/ways-to-circumvent-the-same-origin-policy, I believe you cannot set a cookie for a domain other than the current site. – oliakaoil Jul 23 '14 at 14:04

0 Answers0