We have the following configuration: testing.parentdomain

When you access this domain and create a basket we create a cookie stored for the basket value. The cookie domain is set to .testing.parentdomain, it is Httponly and has a path of /

We have a subdomain to the above which would like to access the cookie. subdomain.testing.parentdomain
This sub domain makes a call to an endpoint on the parent domain such as: testing.parentdomain/basketData. This call is a GET request that returns JSON.

Issue
The issue is that the subdomain does not appear to send the cookie value when making the request and therefore we do not get the expected response.

Attempts
Looking at other questions we have tried CORS and credential changes.
As an additional note, we bundle the below JS with webpack/babel.
Our request is from AJAX as follows:

  $.ajax({
    url: url,
    type: 'GET',
    xhrFields: {
      withCredentials: true
    },
    crossDomain: true
  })

The server is setup with CORS for the subdomain and allow-crendtials. In the response we can see these are returned.
access-control-allow-credentials: true
access-control-allow-origin: subdomain from above

Is there any reason that the cookie is not sent with the request to the parent domain? We have logged out the cookies on the server side response and they are not there as we expect.

Request Headers

:authority: testing.parentdomain
:method: GET
:path: /basket/data/
:scheme: https
accept: /
accept-encoding: gzip, deflate, br
accept-language: en-GB,en;q=0.9,en-US;q=0.8
origin:
referer: /
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-site
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36

Response Headers

access-control-allow-credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin:
cache-control: no-cache, no-store
content-length: 2238
content-type: application/json; charset=utf-8
date: Tue, 03 Nov 2020 20:39:36 GMT
expires: -1
pragma: no-cache
server: Microsoft-IIS/10.0
set-cookie: AWSALB=N0bcThdgRFzrSfQVNIsffgsvY6T/y2Bp47RZJCueeSLOS7eEjo0AThiElXmww6fy2eynRyyt8gAB8di/Mqy1x+Ds8Ig1TumKkWnQiFvIkoELI/rEYYgyUxbEtUI4; Expires=Tue, 10 Nov 2020 20:39:36 GMT; Path=/
set-cookie: AWSALBCORS=N0bcThdgRFzrSfQVNIsffgsvY6T/y2Bp47RZJCueeSLOS7eEjo0AThiElXmww6fy2eynRyyt8gAB8di/Mqy1x+Ds8Ig1TumKkWnQiFvIkoELI/rEYYgyUxbEtUI4; Expires=Tue, 10 Nov 2020 20:39:36 GMT; Path=/; SameSite=None; Secure
status: 200
strict-transport-security: max-age=31536000;
vary: Origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-robots-tag: noindex
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

We have the following configuration: testing.parentdomain.com

When you access this domain and create a basket we create a cookie stored for the basket value. The cookie domain is set to .testing.parentdomain.com, it is Httponly and has a path of /

We have a subdomain to the above which would like to access the cookie. subdomain.testing.parentdomain.com
This sub domain makes a call to an endpoint on the parent domain such as: testing.parentdomain.com/basketData. This call is a GET request that returns JSON.

Issue
The issue is that the subdomain does not appear to send the cookie value when making the request and therefore we do not get the expected response.

Attempts
Looking at other questions we have tried CORS and credential changes.
As an additional note, we bundle the below JS with webpack/babel.
Our request is from AJAX as follows:

  $.ajax({
    url: url,
    type: 'GET',
    xhrFields: {
      withCredentials: true
    },
    crossDomain: true
  })

The server is setup with CORS for the subdomain and allow-crendtials. In the response we can see these are returned.
access-control-allow-credentials: true
access-control-allow-origin: subdomain from above

Is there any reason that the cookie is not sent with the request to the parent domain? We have logged out the cookies on the server side response and they are not there as we expect.

Request Headers

:authority: testing.parentdomain.com
:method: GET
:path: /basket/data/
:scheme: https
accept: /
accept-encoding: gzip, deflate, br
accept-language: en-GB,en;q=0.9,en-US;q=0.8
origin: https://subdomain.testing.parentdomain.com
referer: https://subdomain.testing.parentdomain.com/
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-site
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36

Response Headers

access-control-allow-credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://subdomain.testing.parentdomain.com
cache-control: no-cache, no-store
content-length: 2238
content-type: application/json; charset=utf-8
date: Tue, 03 Nov 2020 20:39:36 GMT
expires: -1
pragma: no-cache
server: Microsoft-IIS/10.0
set-cookie: AWSALB=N0bcThdgRFzrSfQVNIsffgsvY6T/y2Bp47RZJCueeSLOS7eEjo0AThiElXmww6fy2eynRyyt8gAB8di/Mqy1x+Ds8Ig1TumKkWnQiFvIkoELI/rEYYgyUxbEtUI4; Expires=Tue, 10 Nov 2020 20:39:36 GMT; Path=/
set-cookie: AWSALBCORS=N0bcThdgRFzrSfQVNIsffgsvY6T/y2Bp47RZJCueeSLOS7eEjo0AThiElXmww6fy2eynRyyt8gAB8di/Mqy1x+Ds8Ig1TumKkWnQiFvIkoELI/rEYYgyUxbEtUI4; Expires=Tue, 10 Nov 2020 20:39:36 GMT; Path=/; SameSite=None; Secure
status: 200
strict-transport-security: max-age=31536000;
vary: Origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-robots-tag: noindex
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

• javascript
• jquery
• cookies
• cors
• setcookie

• Server doesn't logs the cookie, ok. Have you checked if the cookie is set on the client browser? Have you inspected the GET request (from the client browser) to check if the cookie is in the headers? These checks would help to distinguish if the problem is sending the cookie to server or setting the cookie on the client. Probably you already did this check, could you please confirm? Thank you – Daniele Ricci Commented Oct 11, 2020 at 14:15
• Yes, we've confirmed the cookie is set correctly. The cookie is not sent with the request and/or it is not received by the response. Yes we are logging out the request cookies on the server to be able to determine this – StuartM Commented Oct 13, 2020 at 12:33
• It would be useful if you add http request and response with header as you can see in browser console. – Lety Commented Oct 13, 2020 at 13:54
• I strongly agree with @Lety – Daniele Ricci Commented Oct 13, 2020 at 17:11
• is it possible to leave only the parent domain on the cookie? – Liran Commented Oct 15, 2020 at 13:30

2 Answers 2

Even if you are calling the main domain from a subdomain, this is considered a cross-origin request.

Quote from the RFC 6454 which qualifies the "Origin" term:

Q: Why use the fully qualified host name instead of just the "top-
level" domain?

A: Although the DNS has hierarchical delegation, the trust
relationships between host names vary by deployment. For example, at many educational institutions, students can host content at
https://example.edu/~student/, but that does not mean a document
authored by a student should be part of the same origin (i.e.,
inhabit the same protection domain) as a web application for managing grades hosted at https://grades.example.edu/.

So all of the things you did are indeed required to make it work:

• access-control-allow-credentials: true
• access-control-allow-origin: https://subdomain.testing.parentdomain.com (not a wildcard)
• withCredentials: true in the request

The SameSite=None cookie attribute is not required in this case because a request from a subdomain to another subdomain of the same domain is considered "same site" (Source).

So just check that everything is correctly set, it should work as is.

At beginning of your question you stated:

The cookie domain is set to .testing.parentdomain.com

but in the logged server response:

set-cookie: AWSALBCORS=N0bcThdgRFzrSfQVNIsffgsvY6T/y2Bp47RZJCueeSLOS7eEjo0AThiElXmww6fy2eynRyyt8gAB8di/Mqy1x+Ds8Ig1TumKkWnQiFvIkoELI/rEYYgyUxbEtUI4; Expires=Tue, 10 Nov 2020 20:39:36 GMT; Path=/; SameSite=None; Secure

the Domain=.testing.parentdomain.com; parameter is clearly missing.

I don't know which programming language you are using to set the cookie, but I strongly suggest you to check the call you use to set the cookie in your server response.