Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this?

  • Does any version of any browser set the cookie for example.com, so that it will travel in subsequent requests(requests in compliance to SOP) to example.com
share|improve this question
add comment

3 Answers 3

I'm not sure if browsershots will handle this - since it seems to be mainly focused on looks, rather than behaviour.

An XHR response, if it issues a "Set-Cookie" header, it will be included in further requests. From http://www.w3.org/TR/XMLHttpRequest:

 If the user agent supports HTTP State Management it should persist, discard
 and send cookies (as received in the Set-Cookie response header, and sent in
 the Cookie header) as applicable.

I just tested in FF13, and XHR requests set cookie values.

share|improve this answer
add comment

Yes, I believe the browser will accept the cookie from the server, if you're allowed to send the request. I believe this should be true on all modern browsers.

But you can always test it yourself, if in doubt. Browsershots is a great tool for this sort of thing, and it is free.

share|improve this answer
add comment

The behaviour of XHR request depends on browsers' implementation. The answer for your question (about Set-Cookie and all stuff related to XHR SOP) are here: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_XMLHttpRequest

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.