Cross-Domain Cookies – Dev

The best answers to the question “Cross-Domain Cookies” in the category Dev.


I have two webapps WebApp1 and WebApp2 in two different domains.

  1. I am setting a cookie in WebApp1 in the HttpResponse.
  2. How to read the same cookie from HttpRequest in WebApp2?

I know it sounds weird because cookies are specific to a given domain, and we can’t access them from different domains; I’ve however heard of CROSS-DOMAIN cookies which can be shared across multiple webapps. How to implement this requirement using CROSS-DOMAIN cookies?

Note: I am trying this with J2EE webapps


As other people say, you cannot share cookies, but you could do something like this:

  1. centralize all cookies in a single domain, let’s say
  2. when the user makes a request to you redirect him to
  3. redirects him back to with the information you need

Of course, it’s not completely secure, and you have to create some kind of internal protocol between your apps to do that.

Lastly, it would be very annoying for the user if you do something like that in every request, but not if it’s just the first.

But I think there is no other way…


Yes, it is absolutely possible to get the cookie from by I had the same problem for a social plugin of my social network, and after a day of research I found the solution.

First, on the server side you need to have the following headers:

header("Access-Control-Allow-Origin: http://origin.domain:port");
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Methods: GET, POST");
header("Access-Control-Allow-Headers: Content-Type, *");

Within the PHP-file you can use $_COOKIE[name]

Second, on the client side:

Within your ajax request you need to include 2 parameters

crossDomain: true
xhrFields: { withCredentials: true }


type: "get",
url: link,
crossDomain: true,
dataType: 'json',
xhrFields: {
  withCredentials: true


There’s no such thing as cross domain cookies. You could share a cookie between and but never between and and that’s for security reasons.


As far as I know, cookies are limited by the “same origin” policy. However, with CORS you can receive and use the “Server B” cookies to establish a persistent session from “Server A” on “Server B”.

Although, this requires some headers on “Server B”:

Access-Control-Allow-Credentials: true

And you will need to send the flag “withCredentials” on all the “Server A” requests (ex: xhr.withCredentials = true;)

You can read about it here: