I had a problem with CORS with node and angular and adding this option with true solved my problem.
But I don't find info about what it is and what it is doing.
Please can someone explain?
I had a problem with CORS with node and angular and adding this option with true solved my problem.
But I don't find info about what it is and what it is doing.
Please can someone explain?
Short answer:
withCredentials()
makes your browser include cookies and authentication headers in your XHR request. If your service depends on any cookie (including session cookies), it will only work with this option set.
Longer explanation:
When you issue an Ajax request to a different origin server, the browser may send an OPTIONS pre-flight request to the server to discover the CORS policy of the endpoint (for non-GET requests).
Since the request may have been triggered by a malicious script, to avoid automatically leaking authentication information to the remote server, the browser applies the following rules :
For GET requests, include cookie and authentication information in the server request :
withCredentials
option is set to trueAccess-Control-Allow-Credentials: true
, discard response before returning the object to JavascriptFor non GET requests, include cookie and authentication information only:
withCredentials
is set to true on the XHR objectAccess-Control-Allow-Credentials: true
in the pre-flight OPTIONS