title: How can I add a spring security JSESSIONID with SockJS and STOMP when doing a cross-domain request?
body: <p>I am having the following problem. I will describe 3 use cases - two which work and the other one which doesn't.</p>
  
  <p>I have an AngularJS client using SockJS with STOMP. In the backend I have a Spring application. Client is in domain domainA.com, backend is in domainB.com.</p>
  
  <pre><code>var socket = new SockJS(("http://domainB.com/myApp/messages"));
  stompClient = Stomp.over(socket);
  stompClient.connect('guest', 'guest', function(frame) {
      ...
  }
  </code></pre>
  
  <p>In the backend there are Cors filters and the Cross-origin calls are possible. All works fine.</p>
  
  <p><strong>Use Case 1.</strong> Client domainA, Server domainB</p>
  
  <p>My application is unsecured on the backend side. I subscribe like below:</p>
  
  <pre><code>stompClient.subscribe('/topic/listen', function(message) {
      showMessage(JSON.parse(message.body).content);
  });
  </code></pre>
  
  <p>All works fine.</p>
  
  <p><strong>Use Case 2.</strong> Client domainB, Server domainB</p>
  
  <p>My application is secured on the backend side with Spring security. Authentication is done through a form - username and password. Nothing uncommon.</p>
  
  <p>In this case the client is <strong>on domainB.com</strong>, same as the backend. All works fine, the difference is that I use a different subscription method:</p>
  
  <pre><code>stompClient.subscribe('/user/queue/listen', function(message) {
      showMessage(JSON.parse(message.body).content);
  });
  </code></pre>
  
  <p>in order to benefit from getting the principal from the security session. All works well. No issues.</p>
  
  <p>The JSESSIONID cookie is added to the connection request in <strong>new SockJS(("<a href="http://domainB.com/myApp/messages" rel="nofollow">http://domainB.com/myApp/messages</a>"));</strong>.</p>
  
  <p><strong>Use Case 3.</strong> Client domainA, Server domainB</p>
  
  <p>The application is secured the same as in UC2. However, the client is now on a different domain.</p>
  
  <p>The JSESSIONID is <strong>NOT</strong> added to the connection request. The connection to websocket in Spring is unauthenticated and redirected back to login page. This repeats and makes it impossible to connect.</p>
  
  <p>Why is the <strong>JSESSIONID cookie not populated</strong> with the websocket requests in this case?</p>
  
  <p>Cheers
  Adam</p>