CORS user credentials about cors-anywhere HOT 2 CLOSED

This is mostly done for security reasons. When withCredentials is enabled, things like cookies are automatically included in each request. Cookies are tied to (sub)domains and optionally a specific path. CORS Anywhere has a single domain, so allowing credentials would result in leakage of cookies between proxied sites.

Technically, it would be possible to parse cookies and modify the target domain and path of the cookie, but then there is another problem: If multiple sites use the same CORS Anywhere domain with cookies, then the per-domain cookie size limit will prevent cookies from working correctly.

And please note that even if withCredentials were to be supported for CORS Anywhere, then the users' cookies for the proxied site are not included in the request (because from the browser's perspective, CORS Anywhere is not the same domain as proxied site, cors-anywhere.herokuapp.com/example.com vs example.com).

If you need authentication, check if the proxied site supports authentication via headers, e.g. via Basic Authorization or API keys.

from cors-anywhere.

Thank you very much for the quick answer and clear explanations.

I was indeed after (seamlessly) authentication by cookie 'redirection' but from your comments it doesn't seem ideal solution anymore. Will go with your suggestion of authentication via headers.

Furthermore in your debt and very much grateful.

Regards

from cors-anywhere.