I know this may have been answered already but none of the solutions I found are working for me.
I have an AJAX call from example.com to api.example.com/v1, when sending the request, no cookie is sent.
EDIT:
My AJAX code is
$.ajax({
type:"POST",
url:"https://api.example.com/v1/",
data: payload,
processData: false,
xhrFields: { withCredentials:true },
crossDomain: true,
xhrFields: { responseType: 'arraybuffer' },
dataType: 'binary',
contentType: 'application/octet-stream',
headers: { "Csrf-Token": csrfValue, "accept": "application/octet-stream"},
success: function(res) {
// Some code here
}
});
EDIT 2:
The headers set by the server on the preflight request are:
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Csrf-Token, Cookie
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://example.com
allow: OPTIONS, POST
EDIT 3:
My cookie values are:
Name: __Secure-Csrf-Token
Content: 4XAlnRWR95FKGcpYxZb6P9xxtFx1hP7XXU8rSShpnEY
Domain: .example.com
Path: /
Send for: Secure same-site connections only
Created: Wednesday, May 25, 2022 at 11:18:17 PM
Expires: When the browsing session ends
And yes, mi site uses HTTPS.
Okay so it looks like I was repeating the xhrFields param, so the first mention where I set the withCredentials: true was being overwritten.