Home > Article > Web Front-end > An explanation of the solution to cookie loss in ajax cross-domain access
Ajax cross-domain access can be achieved using the jsonp method or setting Access-Control-Allow-Origin. Regarding setting Access-Control-Allow-Origin to achieve cross-domain access, you can refer to the article I wrote before "ajax setting Access-Control- Allow-Origin realizes cross-domain access》
First create two test domain names
a.fdipzone .com As the client domain name
b.fdipzone.com As the server domain name
Test code
setcookie.php Used to set server cookies
<?phpsetcookie('data', time(), time()+3600);?>
server.php Used to be requested by the client
<?php$name = isset($_POST['name'])? $_POST['name'] : '';$ret = array( 'success' => true, 'name' => $name, 'cookie' => isset($_COOKIE['data'])? $_COOKIE['data'] : '');// 指定允许其他域名访问header('Access-Control-Allow-Origin:http://a.fdipzone.com');// 响应类型header('Access-Control-Allow-Methods:POST'); // 响应头设置header('Access-Control-Allow-Headers:x-requested-with,content-type'); header('content-type:application/json');echo json_encode($ret);?>
test.html Client request page
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<script src="//code.jquery.com/jquery-1.11.0.min.js"></script>
<title> ajax 跨域访问cookie丢失的解决方法 </title>
</head>
<body>
<script type="text/javascript">
$(function(){
$.ajax({
url: 'http://b.fdipzone.com/server.php', // 跨域
dataType: 'json',
type: 'post',
data: {'name':'fdipzone'},
success:function(ret){
if(ret['success']==true){
alert('cookie:' + ret['cookie']);
}
}
});
}) </script>
</body></html>First execute http://b.fdipzone.com/setcookie.php to create a server-side cookie .
Then execute http://a.fdipzone.com/test.html
Output
{"success":true,"name":"fdipzone","cookie":""}Failed to obtain cookies.
Client
Set the withCredentials attribute to # when requesting ##true Enables you to specify that credentials should be sent for a certain request. If the server receives a request with credentials, it will respond with the following HTTP headers.
Server Set header
header("Access-Control-Allow-Credentials:true");Allow requests with verification information
test.html Modify as follows
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<script src="//code.jquery.com/jquery-1.11.0.min.js"></script>
<title> ajax 跨域访问cookie丢失的解决方法 </title>
</head>
<body>
<script type="text/javascript">
$(function(){
$.ajax({
url: 'http://b.fdipzone.com/server.php', // 跨域
xhrFields:{withCredentials: true}, // 发送凭据
dataType: 'json',
type: 'post',
data: {'name':'fdipzone'},
success:function(ret){
if(ret['success']==true){
alert('cookie:' + ret['cookie']);
}
}
});
}) </script>
</body></html>
server.php Modify as follows
<?php$name = isset($_POST['name'])? $_POST['name'] : '';$ret = array( 'success' => true, 'name' => $name, 'cookie' => isset($_COOKIE['data'])? $_COOKIE['data'] : '');// 指定允许其他域名访问header('Access-Control-Allow-Origin:http://a.fdipzone.com');// 响应类型header('Access-Control-Allow-Methods:POST'); // 响应头设置header('Access-Control-Allow-Headers:x-requested-with,content-type');// 是否允许请求带有验证信息header('Access-Control-Allow-Credentials:true'); header('content-type:application/json');echo json_encode($ret);?>Follow the previous steps, and the request returns
{"success":true,"name":"fdipzone","cookie":"1484558863"}The cookie is obtained successfully XMLHttpRequest cannot load http://b.fdipzone.com/server.php. Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials. Origin 'http://a.fdipzone.com' is therefore not allowed access.2. After the server header sets Access-Control-Allow-Credentials: true, Access-Control-Allow-Origin cannot be set to * and must be set to a domain name, otherwise an error will be returned.
XMLHttpRequest cannot load http://b.fdipzone.com/server.php. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://a.fdipzone.com' is therefore not allowed access. The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute.This article explains how to solve the problem of cookie loss in ajax cross-domain access. For more related content, please pay attention to the PHP Chinese website. Related recommendations:
Explanation on the calculation method of key_len in mysql explain
How to use curl to simulate ip and Source access
#Convert NULL data through mysql method
The above is the detailed content of An explanation of the solution to cookie loss in ajax cross-domain access. For more information, please follow other related articles on the PHP Chinese website!