CORS requests with session/cookie

Question

My application has a PHP server and a client (a JS single-page app). They are separate projects and deployed in different domains. The client consumes a RESTful API exposed

Answer 1

You must set withCredentials to true for cross-origin XHR requests to include cookies.

The CORS response must also say Access-Control-Allow-Credentials: true (which is why widthCredentials defaults to false).