ASP.NET Web API Security Essentials

Passing credentials in cross-origin requests

Browsers don't pass credentials such as cookies and HTTP authentication schemes by default in cross-origin requests. To enable passing credentials in cross-origin requests from the client, the client has to set XMLHttpRequest.withCredentials to true as given in the following:

$.ajax({
    type: 'get',
    url: ' http://localhost:53858 /api/contacts,
    xhrFields: {
        withCredentials: true
    }

To allow credentials in cross-origin requests, the SupportsCredentials property should be set to true on the [EnableCors] attribute as given in the following code:

[EnableCors(origins: "http://chapter09client.com", headers: "*", methods: "*", SupportsCredentials = true)]

The HTTP response will also have the Access-Control-Allow-Credentials ...