Problem with session ID and Drupal cookies when trying to establish a connection
I had the same problem in Drupal 8. The AJAX POST isn't retrieving the cookie from user/login as Drupal does a redirect right away to another page (user usually) which is where you get your 200. And there is nothing (nothing) you can do to interrupt that redirect as its wired into the browser. Postman in Chrome (and I presume Poster in Firefox) don't have those restrictions.

In Drupal 7 the Services module provides a login endpoint. After that you can retrieve the session ID and create the cookie by hand. See https://groups.drupal.org/node/358308

In Drupal 8 that endpoint doesn't exist (and there is debate as to whether it should). What I do is:


In the app I create a regular login form with a return destination to my app
&lt;form action="/user/login?destination=/app"&gt;
Once that's done I retrieve a CSRF token as by then the cookie is set. In Drupal 8 you get that at rest/session/token. With Drupal 7 and the Services module you retrieve it at a different path based on your end point.
After that every request goes back with the X-CSRF-Token header and the cookie isn't used anymore.