{"id":2123,"date":"2022-11-30T00:00:36","date_gmt":"2022-11-30T00:00:36","guid":{"rendered":"https:\/\/code-boxx.com\/?p=2123"},"modified":"2023-11-13T02:27:06","modified_gmt":"2023-11-13T02:27:06","slug":"cors-cookie-php","status":"publish","type":"post","link":"https:\/\/code-boxx.com\/cors-cookie-php\/","title":{"rendered":"Set CORS Cookie In PHP (A Step-By-Step Guide)"},"content":{"rendered":"

Welcome to a tutorial on how to set a CORS cookie in PHP. Need to set a cookie in a cross-origin call? Annoyingly got rejected multiple times? Yep, that is security, and it took me hours to figure things out too. So here it is, a quick sharing of my working example – Read on!<\/p>\n

 <\/p>\n

<\/div>\n

 <\/p>\n

TABLE OF CONTENTS<\/h2>\n
\n
Download & Notes<\/a><\/div>\n
Server Setup<\/a><\/div>\n
PHP CORS Cookie<\/a><\/div>\n
Extras<\/a><\/div>\n
The End<\/a><\/div>\n<\/div>\n

 <\/p>\n

\n

DOWNLOAD & NOTES<\/h2>\n

Here is the download link to the example code, so you don’t have to copy-paste everything.<\/p>\n<\/div>\n

 <\/p>\n

EXAMPLE CODE DOWNLOAD<\/span><\/h3>\n

Source code on GitHub Gist<\/a><\/p>\n

Just click on “download zip” or do a git clone. I have released it under the MIT license, so feel free to build on top of it or use it in your own project.<\/p>\n

 <\/p>\n

SORRY FOR THE ADS...<\/span><\/h3>\r\n

But someone has to pay the bills, and sponsors are paying for it. I insist on not turning Code Boxx into a \"paid scripts\" business, and I don't \"block people with Adblock\". Every little bit of support helps.<\/p>\r\n\r\n

Buy Me A Coffee<\/a> Code Boxx eBooks<\/a><\/p>\n

 <\/p>\n

\n

TEST SERVER SETUP<\/h2>\n

For you guys who don’t have multiple domains to do testing, no sweat. Here is how I set up my localhost to emulate multiple domains.<\/p>\n<\/div>\n

 <\/p>\n

OS HOSTS FILE<\/span><\/h3>\n
C:\\Windows\\System32\\drivers\\etc\\hosts<\/div>\n
127.0.0.1 site-a.com\r\n127.0.0.1 site-b.com\r\n::1 site-a.com\r\n::1 site-b.com<\/code><\/pre>\n
First, open the hosts<\/code> file and add the following entries. For the uninitiated, this is just a manual DNS override – Point site-a.com<\/code> and site-b.com<\/code> to localhost.<\/p>\n
P.S. Mac\/Linux users, yours should be in etc\/hosts<\/code>, but it may differ for different distros.<\/p>\n
 <\/p>\n
<\/div>\n
 <\/p>\n
SSL CERT<\/span><\/h3>\n
Next, using https:\/\/<\/code> is a vital part to make CORS cookies work. If you don’t already have your own SSL certs, self-sign and create your own. Not going to walk through that here, but there are plenty of good guides all over the Internet – Do some of your own research.<\/p>\n
 <\/p>\n
VIRTUAL HOSTS<\/span><\/h3>\n
httpd-vhosts.conf<\/div>\n
<VirtualHost *:443>\r\n  DocumentRoot \"D:\/http\/site-a\/\"\r\n  ServerName site-a.com\r\n  SSLEngine On\r\n  SSLCertificateFile \"C:\/xampp\/apache\/conf\/ssl.crt\/server.crt\"\r\n  SSLCertificateKeyFile \"C:\/xampp\/apache\/conf\/ssl.key\/server.key\"\r\n<\/VirtualHost>\r\n<VirtualHost *:443>\r\n  DocumentRoot \"D:\/http\/site-b\/\"\r\n  ServerName site-b.com\r\n  SSLEngine On\r\n  SSLCertificateFile \"C:\/xampp\/apache\/conf\/ssl.crt\/server.crt\"\r\n  SSLCertificateKeyFile \"C:\/xampp\/apache\/conf\/ssl.key\/server.key\"\r\n<\/VirtualHost><\/code><\/pre>\n
Lastly, create the project folders and map the virtual hosts accordingly. That is, https:\/\/site-a.com<\/code> will point to D:\/http\/site-a\/<\/code> and https:\/\/site-b.com<\/code> will point to D:\/http\/site-b\/<\/code>.<\/p>\n
P.S. This is for Apache. IIS and NGINX users – Do your own research.<\/p>\n
 <\/p>\n
<\/div>\n
 <\/p>\n
ACCESS SITE A & SITE B WITH HTTPS<\/span><\/h3>\n
\"\"<\/p>\n