title: Laravel cross site AJAX post with session. Working but with JavaScript error?
body: <p>I'm doing a cross site AJAX post to a laravel website while maintaining the session. This is the JS on the client website and the laravel middleware on my server.</p>
  
  <p><strong>Client js</strong></p>
  
  <pre><code>var formData = new FormData(); 
  formData.append('Referer', document.referrer);
  var xmlHttp = new XMLHttpRequest();
  xmlHttp.open("post", "https://mywebsite.com/record"); 
  xmlHttp.withCredentials = true;
  xmlHttp.send(formData); 
  </code></pre>
  
  <p><strong>Server middleware</strong> </p>
  
  <pre><code>public function handle($request, Closure $next)
  {
  return $next($request)
  -&gt;header('Access-Control-Allow-Origin',         $request-&gt;header('Origin'))
  -&gt;header('Access-Control-Allow-Credential',     'true')
  -&gt;header('Access-Control-Allow-Methods',        'GET, POST, PUT, DELETE, OPTIONS');
  }
  </code></pre>
  
  <p>It seems to be working fine in the 3 browsers I've tested it in so far however it does seem to throw up an error of</p>
  
  <pre><code>XMLHttpRequest cannot load https://mywebsite.com/record. Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials. Origin 'http://clientwebsite.com' is therefore not allowed access.
  </code></pre>
  
  <p>This is what the server sends back in fiddler.</p>
  
  <pre><code>Access-Control-Allow-Origin: http://clientwebsite.com
  Access-Control-Allow-Credential: true
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  </code></pre>
  
  <p>Two questions.</p>
  
  <p>Question 1</p>
  
  <p>First I can't understand why its saying its not working when I know it is? I can see the requests making it to the server then populating my database and I can see them being sent in fiddler.</p>
  
  <p>Question 2</p>
  
  <p>There is obviously something wrong with the headers but I'm not sure what?</p>
  
  <p>I can see someone else has had the same issue but I wasn't able to make sense of the answer and I tried changing the header to "Access-Control-Allow-Credentials = true".</p>
  
  <p><a href="https://stackoverflow.com/questions/33269488/credentials-flag-is-true-but-the-access-control-allow-credentials">Credentials flag is &#39;true&#39;, but the &#39;Access-Control-Allow-Credentials</a></p>