Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I send a XHR request to and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this?

  • Does any version of any browser set the cookie for, so that it will travel in subsequent requests(requests in compliance to SOP) to
share|improve this question

I'm not sure if browsershots will handle this - since it seems to be mainly focused on looks, rather than behaviour.

An XHR response, if it issues a "Set-Cookie" header, it will be included in further requests. From

 If the user agent supports HTTP State Management it should persist, discard
 and send cookies (as received in the Set-Cookie response header, and sent in
 the Cookie header) as applicable.

I just tested in FF13, and XHR requests set cookie values.

share|improve this answer

The behaviour of XHR request depends on browsers' implementation. The answer for your question (about Set-Cookie and all stuff related to XHR SOP) are here:

share|improve this answer

Yes, I believe the browser will accept the cookie from the server, if you're allowed to send the request. I believe this should be true on all modern browsers.

But you can always test it yourself, if in doubt. Browsershots is a great tool for this sort of thing, and it is free.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.