Cross-Site cookie loss caused by Ajax loading subdomains.

We have two websites: main.xxx.cn and prevei?xxx.cn.

The main.xxx.cn page needs to load the content of preview.xxx.cn.

There are two ways to load preview.xxx.cn content in the project. One is IFRAME and the other is Ajax.

1. IFRAME loading requires that document. Domain = be set to the root domain name xxx.cn on both pages.
(Other thickbox Magnific Popup. If the page under the same domain name is loaded, the document. Domain owner needs to be set, which also causes JS access failure. Because the domain name has been changed ).

2. Set Orign during Ajax loading.

Fresponse. addheader ("access-control-allow-origin", origin );

The origin tag can be seen through firebug about HTTP (s): // main.xxx.cn can also be used *

However, if this parameter is set only, the original cookie value of preview.xxx.cn cannot be passed. You need to set withcredentials as follows. In addition, the orgin value must be set to exactly the same, and the wildcard * cannot be used *.

You also need to add an httpheader.
Response. addheader ("access-control-allow-credentials", "true ");

$. Ajax ({
URL: 1. aspx
Datatype: "html ",
Xhrfields :{
Withcredentials: True
},

}

 

Cross-Site cookie loss caused by Ajax loading subdomains.