title: Drupal and CORS request made by Axios: unable to check login status
body: <p>I am creating standalone html/javascript application which should communicate with REST API of Drupal 8.6.2. My app uses Vue.js, so ajax requests are sent by Axios.</p>
  
  <p>I want to be able to operate the app both on the same domain and via CORS from another domain. Let's say my Drupal sits on <a href="https://drupal8.example.org" rel="nofollow noreferrer">https://drupal8.example.org</a></p>
  
  <p>I can login and logout from <a href="https://drupal8.example.org/app" rel="nofollow noreferrer">https://drupal8.example.org/app</a> and from <a href="http://localhost/app" rel="nofollow noreferrer">http://localhost/app</a> without problem with the following code:</p>
  
  <pre><code>//Login
  axios.post(
    "https://drupal8.example.org/user/login?_format=json",
    JSON.stringify({
      'name': "myusername",
      'pass': "mypassword"
  }), {
    headers: {
      'Content-Type': 'application/hal+json'
    },
    withCredentials: true
  }).
  then(function (response) {
    //my code goes here
  });
  
  // logout
  axios.post(
    "https://drupal8.example.org/user/logout?_format=json&amp;token=" + logout_token, {}, {
      headers: {
        'Content-Type': 'application/hal+json'
      },
      withCredentials: true
    }
  ).
  then(function () {
    //my code goes here
  })
  </code></pre>
  
  <p>But I am totally <strong>unable to check by CORS if the user is logged in:</strong></p>
  
  <pre><code>//check login status
  axios.get(
    "https://drupal8.example.org/user/login_status?_format=json", {}, {
      headers: {
        'crossDomain': true,
        'Content-Type': 'application/hal+json'
      },
      withCredentials: true
    }
  ).then(function (response) {
    console.log(response.data); // 1 from the same domain, 0 from localhost; should be 1 in both cases
  });
  </code></pre>
  
  <p>If I check the url <a href="https://drupal8.example.org/user/login_status?_format=json" rel="nofollow noreferrer">https://drupal8.example.org/user/login_status?_format=json</a> in browser window, it displays <strong>1</strong>, but request made by CORS returns <strong>0</strong>.</p>
  
  <p>What is the cause of problem and how to solve it?</p>