Set-Cookie session not being set after sign_in with cross-domain

Question

I have a rails app that has 2 subdomains:

API (CORS) => api.myapp.dev
Web App => myapp.dev

I can only access my API via auth_token which is returned right after user's authentication using Devise. However, my client (web app) is not setting these cookies. Am I missing something?

class Api::V1::SessionsController < Api::V1::BaseController def create @user = User.find_for_database_authentication(:email => params[:user][:email]) if @user and @user.valid_password?(params[:user][:password]) sign_in @user # Set-Cookie header response with the session render "api/v1/users/preview", :handlers => :rabl # return auth_token here else flash[:error] = I18n.t('devise.failure.invalid') render "api/v1/base/error", :handlers => :rabl, :status => :unprocessable_entity end end end

Same problem here

Nathan G
– Nathan G

2020-03-13 15:39:51 +00:00
Commented Mar 13, 2020 at 15:39 — Nathan G
– Nathan G, Commented Mar 13, 2020 at 15:39

mateusmaso · Accepted Answer · 2017-02-18 00:36:21Z

For security reasons you can't set cookies from cross-domain websites. However, jQuery.ajax let's you do this by explicitly setting the following options:

$.ajax type: "POST" url: "api.mydomain.com/login" xhrFields: withCredentials: true

Also, make sure to return headers['Access-Control-Allow-Credentials'] = "true" from your HTTP response.

Collectives™ on Stack Overflow

Set-Cookie session not being set after sign_in with cross-domain

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related