Internet Explorer 10忽略XMLHttpRequest'xhr.withCredentials = true' [英] Internet Explorer 10 is ignoring XMLHttpRequest 'xhr.withCredentials = true'

问题描述

我目前在使用IE10的跨网域ajax呼叫时遇到问题（在IE10模式中，不兼容）。

I’m currently having an issue with a cross-domain ajax call using IE10 (in IE10 mode, not compatibility).

情况：
有两个域， http：// a 和 http：// b 。我有一个设置为 http：// b 的cookie。我目前在 http：// a 页。

Situation: I have two domains, http://a and http://b. I have a cookie set for http://b. I am currently on page http://a.

我要对 http：// b 使用XMLHttpRequest（根据http://blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx），并在请求中包含cookie。
JS如下：

I want to do a CORS request to http://b using XMLHttpRequest (which should work, according to http://blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx), and include the cookie in the request. The JS is as follows:

var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://b', true);
xhr.withCredentials = true;
xhr.send();

这应确保cookie附加到请求;然而，Fiddler跟踪显示没有附加cookie，并且我得到 401：Access Denied 。

This should ensure that the cookie is attached to the request; however, the Fiddler trace shows that no cookie is attached, and I get 401: Access Denied.

服务器配置为使用CORS，它包括Access-Control头：

The server is configured to work with CORS, it includes the Access-Control headers:

Access-Control-Allow-Origin: http://a
Access-Control-Allow-Credentials: true

差异，因为没有OPTIONS预检请求，并且第一请求IE发送是GET，并且cookie不存在，因此导致401）。

(this should not make any difference, since there is no OPTIONS preflight request, and the first request IE sends is a GET, and the cookie is not present, thus causing a 401).

这个JS代码片段在Firefox和Opera都可以正常工作。

Furthermore, the JS snippet works fine in both Firefox and Opera.

推荐答案

使用IE的默认设置，如果在响应中设置了没有P3P标头的Cookie，则Cookie被标记为仅限第一方。这意味着在第三方上下文（如iframe或CORS请求）中，IE将拒绝发送cookie。

It's probably the same old IE P3P issue. With IE's default settings, if a cookie is set without a P3P header also present in the response, the cookie is marked as "first-party only". Which means that in a third-party context, such as an iframe or a CORS request, IE will refuse to send the cookie.

要解决此问题，您需要提供设置Cookie时的P3P标头。请参见 http://msdn.microsoft.com/en-us/library /ms537343%28v=vs.85%29.aspx 了解详情。

To fix it, you need to supply a P3P header when setting the cookies. See http://msdn.microsoft.com/en-us/library/ms537343%28v=vs.85%29.aspx for details.

更新：链接已经停止，但您可以在互联网档案< a>

Update: Link is now dead, but you can see it at the Internet Archive

这篇关于Internet Explorer 10忽略XMLHttpRequest'xhr.withCredentials = true'的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！