I'm making a POST
request to my own server using the web's native fetch
.
When I use fetch
, the response contains neither cookies that the server adds to the response nor cookies that the AWS ELB is adding for session stickiness.
Using curl
I can confirm the cookies are being added to the response (values redacted and some unncessary fields removed):
curl -v -X POST -H "Authorization: token xxx" myserver.com
* Trying <IP>
* TCP_NODELAY set
* Connected to myserver.com (<IP>) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate: ...
> POST endpoint HTTP/1.1
> Host: myserver.com
> User-Agent: curl/7.54.0
> Accept: */*
> Authorization: token xxx
>
< HTTP/1.1 201 Created
< access-control-allow-credentials: true
< access-control-allow-headers: Authorization
< access-control-allow-origin: http://localhost:3000
< content-security-policy: frame-ancestors 'self'; report-uri /hub/security/csp-report; default-src 'none'
< content-type: text/plain
< date: Wed, 01 Aug 2018 19:30:18 GMT
< server: TornadoServer/5.1
< set-cookie: my-custom-cookie=c00kie; Path=/
< Set-Cookie: AWSELB=<AWS_COOKIE>;PATH=/
< Content-Length: 177
< Connection: keep-alive
<
* <Response>
When I use fetch
, however, the response is this:
fetch(`https://myserver.com/endpoint`, {
method: 'POST',
headers: headers,
credentials: 'include',
})
//
access-control-allow-credentials: true
access-control-allow-headers: Authorization
access-control-allow-origin: http://localhost:3000
Connection: keep-alive
Content-Length: 177
content-security-policy: frame-ancestors 'self'; report-uri
/hub/security/csp-report; default-src 'none'
content-type: text/plain
date: Wed, 01 Aug 2018 19:21:58 GMT
server: TornadoServer/5.1
x-jupyterhub-version: 0.9.1
(Value is taken from the Chrome console Network tab—I'm unable to post images)
I'm assuming this has to do with CORS—the fetch
request is coming from a browser. However, I've set credentials: 'include'
on the fetch
request as per this: https://developer.mozilla.org/en-US/docs/Web/API/Request/credentials
How can I configure fetch
to allow for cookies to be sent and received cross-origin?
Aucun commentaire:
Enregistrer un commentaire