Dart BrowserClient POST not including my cookies

Question

I'm doing a BrowserClient POST across domains and don't see my cookies being included.

This the response I'm getting:

When I send another POST request, I don't see the cookies being included:

Going straight to the test page, I can see the cookies being included:

The Dart code I use to make a POST:

var client = new BrowserClient();

client.post(url, body: request, headers:{"Content-Type" : "application/json", "Access-Control-Allow-Credentials":"true"}).then((res) {
      if (res.statusCode == 200) {
        var response = JSON.decode(res.body);

        callback(response);
      } else {
        print(res.body);
        print(res.reasonPhrase);
      }
    }).whenComplete(() {
      client.close();
    });

Not sure about the Access-Control-Allow-Credentials header I'm including, with or without it, nothing changes.

Am I missing headers on the server side that needs to be set on the response or is Dartium blocking cross-domain cookies?

More details on Information Security and the reasoning behind setting cookies via the server.

Update: Enhancement request logged: https://code.google.com/p/dart/issues/detail?id=23088

Update: Enhancement implemented, one should now be able to do var client = new BrowserClient()..withCredentials=true; based on https://github.com/dart-lang/http/commit/9d76e5e3c08e526b12d545517860c092e089a313

Answer 1

For cookies being sent to CORS requests, you need to set withCredentials = true. The browser client in the http package doesn't support this argument. You can use the HttpRequest from dart:html instead. See How to use dart-protobuf for an example.