lundi 2 septembre 2019

HTTP -- 'set-cookie' field get ignored by browser

I am working on a web with react as frontend and go as backend. The web is on mydomain:8080, and the backend api is on mydomain:8081. In my backend program, I set cookie by:

    w.Header().Set("Access-Control-Allow-Origin", "*")
    w.Header().Set("Access-Control-Allow-Headers", "*")
    w.Header().Set("Access-Control-Allow-Credentials", "true")

    cookie := &http.Cookie{
        Name:       "KeepLogIn",
        Value:      cookieContent,
        Path:       "/",
        Expires:    time.Now().Add(10 * time.Minute),
        Domain:     "mydomain",
    }
    fmt.Println(cookie.String())
    http.SetCookie(w, cookie)

And in my frontend program, I set cookie by:

fetch('http://mydomain:8081/xxxx', {
            method: 'POST',
            headers: {
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Expose-Headers': '*',
                'Content-Type': 'text/plain',
                'Accept': '*',
            },
            mode: 'cors',
            cache: 'default',
            body: JSON.stringify(data),
            credentials: 'same-origin',
        })

I test it in Safari, Chrome and Firefox, all of them can receive the response with correct set-cookie field, but none of them can set cookie. I think this may be related to the cross origin stuff, but I just can't figure out what I can do.




Aucun commentaire:

Enregistrer un commentaire