Javascript fetch is not sending Cookie Header (CORS)

user_7733524 0
Viewed 2532

I am trying to send Cookies to a PHP Script within a javascript fetch CORS request. The Request starts on https://sub1.example.com and contains the following options:

let response = await fetch('https://sub2.example.com/target.php', {
    method: "POST",
    headers: headers,
    body: formData,
    mode: 'cors',
    credentials: 'include',
    cache: 'no-store'
});

The corresponding PHP Script sets the following Headers:

header('Access-Control-Allow-Origin: https://www.example.com');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Headers: Origin, Content-Type, Accept, Authorization, X-Request-With, Set-Cookie, Cookie, Bearer');

But the Cookie Header is not send with the request. I also tried:

let headers = new Headers();
headers.set('Cookie', document.cookie);

That also had no effect. What exactly am I doing wrong here?

I checked the Network Tab in the Development Tools. Also $_COOKIE in the PHP Script is empty. There is absolutely no error. I can also see that the Cookie Header is sent in any not CORS fetch request.

EDIT: Here are the Settings of one of the Cookies:

Name: PHPSESSID
Path: /
Secure: true
SameSite: none

I can't share the Domain because it's not public. But the Cookie Domain has the same Value as the Origin in the Request Header (Minus the https://).

EDIT 2: Changed the fetch URL to make clearer what's happening.

fetch attributes cookies javascript
2 Answers

Problem

Be aware that, depending on

  • the value of the cookie's Path attribute,
  • the effective value of the cookie's Domain attribute,
  • the value of the cookie's Secure attribute,
  • the effective value of the cookie's SameSite attribute,
  • the request's issuing and destination origins,

a cookie may or may not be attached to the request. Of particular relevance to your case is the Domain attribute; check out MDN's page on the topic:

The Domain attribute specifies which hosts can receive a cookie. If unspecified, the attribute defaults to the same host that set the cookie, excluding subdomains. If Domain is specified, then subdomains are always included. Therefore, specifying Domain is less restrictive than omitting it. However, it can be helpful when subdomains need to share information about a user.

You're setting the cookie as follows on origin https://sub1.example.com:

Set-Cookie: PHPSESSID=whatever; Path=/; SameSite=None; Secure

Therefore, that cookie will get attached to (credentialed) requests whose destination origin is https://sub1.example.com, and no other.

Solution

If you want your cookie to be sent to all secure origins whose domain is an example.com subdomain, you need to explicitly set its Domain to example.com.

About sending cookies with fetch

The Fetch standard specifies a list of forbidden header names; Cookie is one of them. You cannot set a header named Cookie on a request sent with fetch; the standard simply forbids it. If you want to attach existing cookies to a cross-origin request, use the 'include' value for the credentials parameter passed in fetch options.

user_25415730
user_13901710
Related