Wait for CORS cookie to be set before location.href redirect

Viewed 1060

I'm trying to make a login that persists across more than one domain (that I control). My strategy is, after a successful login response, I send out a CORS request to get a cookie for each of the other required domains. On return of the cookies, I redirect to the users' homepage (which may be on any of the domains)

I am finding that everything works if I comment out the redirect: all the CORS cookies are set, and I am logged in at the other domains. However, when I redirect, the CORS cookies are sometimes not set. Here is the general idea of my code on the client side:

    // This is running client side when the user visits "A.com/index.html"
    // PLEASE NOTE: the distinction between A.com and B.com is important

     $.post('https://A.com/attemptLogin', function(data) {
        if (!data.success) { return; }
        var token = data.loginToken;
        var userURL = data.userURL; // userURL may be in A.com or B.com...
        // now get a cookie at the alternate domain B.com
        $.ajax({
            url: 'http://B.com/getDomainCookie/' + token,
            method: 'GET',
            xhrFields: { withCredentials: true },
            success: function() {
                // if I comment out the next line, the cookie is always set successfully
                // if I leave the line in, it is hit or miss whether the cookie is set.
                location.href = userURL;
            }
        });
    });

My guess is that the ajax callback is triggered before the browser is finished setting the cookie, possibly related to the fact that it is a B.com cookie, and this code is running on A.com.

Any help is appreciated. This is my first question posted, so constructive criticism on question ettiquette and formatting is also appreciated!

1 Answers

I put in a 50 ms delay window.setTimeout(function() { location.href='';}, 50); Gives it a little idle time to stash to cookie. On another note, doesn't seem to work at all in incognito window, ditches all the CORS cookies.

Related