Same Origin request were fine.
Cross origin request has some limitations.
File:1.php:
<?php
setcookie("cookie_name_1", "cookie_value_1", time() + (86400 * 30), "/");
?>
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://foo.ir/2.php', true);
xhr.withCredentials = true;
xhr.onreadystatechange = function() {
if(this.readyState == xhr.DONE) {
get_res();
}
}
xhr.send(null);
function get_res(){
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://foo.ir/2.php?is_set', true);
xhr.withCredentials = true;
xhr.onload = function () {
if (xhr.readyState === xhr.DONE) {
if (xhr.status === 200) {
console.log(xhr.responseText);
}
}
};
xhr.send(null);
}
</script>
File:2.php
<?php
header('Access-Control-Allow-Origin: http://localhost');
header('Access-Control-Allow-Credentials: true');
if(isset($_GET["is_set"])){
if(isset($_COOKIE["cookie_name_2"]))
echo "cookies are set:".$_COOKIE["cookie_name_2"];
else
echo "cookies not set";
}else
setcookie("cookie_name_2", "cookie_value_2", time() + (86400 * 30), "/");
?>
- Cross-origin cookies are working:
You need to allow third party cookies to be set in
browser setting
- I couldn't find where third party cookies are stored.
- Chrome Won't show cookies and wont effect the real website.
- Firefox & Edge save cookies in the third party website storage thus it will effect real third party website.
More information can be found on Here
According to the XMLHttpRequest Level 1 and XMLHttpRequest Level 2,
this particular response headers falls under the "forbidden" response
headers that you can obtain using getResponseHeader(), so the only
reason why this could work is basically a "naughty" browser
