Set a cookie on another domain using ajax and php - FAILS

Question

Domain-Being-Browsed.com has a javascript function, which when triggered makes an ajax call to a php file on another domain: another-domain.com/set-cookie.php

set-cookie.php contains code like this:

header("Access-Control-Allow-Origin: http://localhost:3000");
header("Access-Control-Allow-Credentials: true");
$cookie_set = FALSE;
$cookie_set = setcookie( 'cookie_name', 'cookie_value', $a_big_number, '/' );
if( $cookie_set ){  echo 'cookie set!';  }

The javascript function is like this:

var url = 'http://another-domain.com/set-cookie.php';
$.ajax({
  'url': url,
  'xhrFields': {
    withCredentials: true
  }
}).done(function(resp){
console.log(resp);
});

If I visit http://another-domain.com/set-cookie.php in my browser, it sets the cookie. If I trigger the javascript function, I get a response in the console, 'cookie set!', but when I load http://another-domain.com in my browser, I find that the cookie is not there.

I found this post: Can't set cookie on different domain, which seems exactly like mine, but the answer given I've incorporated already and it doesn't help. What am I missing?

When using the javascript function, no. If I visit the php page in the browser, then yes, the cookie is created and this is visible in Developer Tools. — Chad Phillips, Dec 18 '20 at 00:29
No errors at all - just the message from the php file indicating that the cookie was set successfully. — Chad Phillips, Dec 18 '20 at 00:47
Do you see the `Set-Cookie` header in the response in the Network tab? — Barmar, Dec 18 '20 at 00:48
This is helpful :) There is a message saying that the "SameSite" attribute was not specified and so it defaults to "lax" and was blocked. I need to set it to "None" apparently. Googling that now... — Chad Phillips, Dec 18 '20 at 00:57
Thanks Barmar - that led to the solution, which I'll post here. — Chad Phillips, Dec 18 '20 at 01:06

score 0 · Answer 1 · answered Dec 18 '20 at 01:11

As directed by Barmar, I checked the Network tab in dev tools for the Set-Cookie header in the response. It seems that I needed to set 'SameSite' to 'None'. If you set 'Samesite' to none, you have to set 'secure' also. And if you set secure, you have to load the page over https. So the answer, as found in the answer here: How to fix "set SameSite cookie to none" warning? is to change the php file like this:

header("Access-Control-Allow-Origin: http://localhost:3000");
header("Access-Control-Allow-Credentials: true");
$cookie_options = array(
    'expires' => time() + 60*60*24*30,
    'path' => '/',
    'secure' => true,
    'samesite' => 'None'
);
$cookie_set = FALSE;
$cookie_set = setcookie( 'cookie_name', 'cookie_value', $cookie_options );
if( $cookie_set ){  echo 'cookie set!';  }

and to load the page over https. Works!

Set a cookie on another domain using ajax and php - FAILS

1 Answers1