php - CORS requests with session/cookie

Question

My application has a PHP server and a client (a JS single-page app). They are separate projects and deployed in different domains. The client consumes a RESTful API exposed by the server.

This application is to be integrated with a third party which handles authentication, so users cannot login directly. Our server just receives an SSO token (which comes appropriately signed so that we verify its integrity).

We also enforce security at the transport layer for all requests.

What I'd like to do is, once the SSO token is verified, start a session of my own and then redirect the user to the client. I thought that once the session was created the browser would automatically send the right Cookie header in the asynchronous API calls, but it doesn't seem to be the case.

Is this deliberately disabled due to security reasons?

Answer 1

You must set withCredentials to true for cross-origin XHR requests to include cookies.

The CORS response must also say Access-Control-Allow-Credentials: true (which is why widthCredentials defaults to false).