I'm trying to make a login that persists across more than one domain (that I control). My strategy is, after a successful login response, I send out a CORS request to get a cookie for each of the other required domains. On return of the cookies, I redirect to the users' homepage (which may be on any of the domains)
I am finding that everything works if I comment out the redirect: all the CORS cookies are set, and I am logged in at the other domains. However, when I redirect, the CORS cookies are sometimes not set. Here is the general idea of my code on the client side:
// This is running client side when the user visits "A.com/index.html"
// PLEASE NOTE: the distinction between A.com and B.com is important
$.post('https://A.com/attemptLogin', function(data) {
if (!data.success) { return; }
var token = data.loginToken;
var userURL = data.userURL; // userURL may be in A.com or B.com...
// now get a cookie at the alternate domain B.com
$.ajax({
url: 'http://B.com/getDomainCookie/' + token,
method: 'GET',
xhrFields: { withCredentials: true },
success: function() {
// if I comment out the next line, the cookie is always set successfully
// if I leave the line in, it is hit or miss whether the cookie is set.
location.href = userURL;
}
});
});
My guess is that the ajax callback is triggered before the browser is finished setting the cookie, possibly related to the fact that it is a B.com cookie, and this code is running on A.com.
Any help is appreciated. This is my first question posted, so constructive criticism on question ettiquette and formatting is also appreciated!