The issue of creating cookies across domains in the browser

When we use Ajax to submit a request to the www.b.com domain under the www.a.com domain, the browser is not allowed by default because it violates the browser's same-origin policy. The solution can refer to the author's blog post: http://www.cnblogs.com/anai/p/4227157.html

Another problem that is discussed here is that when a request is submitted to the www.b.com domain, the background attempts to bind the cookie information in the response to inform the browser to save the cookie, but by default the browser does not create a cookie for you, The specific phenomenon is that you are now responding with a Set-cookie response header and have a value, and the browser will also have information to show that the cookie has been received, but it is not found in the cookie. Yes, that's because you're a cross-domain request to create a cookie. So what if we had to have a browser to create this cookie? Here you will use the attribute Xhrfields for a XMLHttpRequest object, which is explained in the official document as follows:

A Map of Fieldname-fieldvalue pairs to set on the native XHR object. For example, you can use it to set the to withCredentials true Cross-domain requests if needed.

This means that the property is a key-value pair used to configure the Xhr object, such as you can set withcredentials:true when a cross-domain request is needed

So what does withcredentials:true mean?

This property tells the browser, 1, allows the creation of cookie information from different domains, and 2, each time a cross-domain request is allowed to bring the cookie information

This configuration item also requires background permission to be valid, if the background allows the browser to send a request with credentials, then in the response header with "Access-control-allow-credentials", the value is "true".

If this response header is not added, the browser will not get the response body to the server.

Well, by this we already know how to create cookies across domains and bring cookies on every cross-domain request, simply to say that the front desk configures an ajax parameter: Xhrfields:{withcredentials:true}, Some of the information said also to set up crossdomain:true, but I do not think the test is required; background to bind "access-control-allow-credentials" in the response header, the value is "true".

The issue of creating cookies across domains in the browser