<div dir="ltr"><div>Hi Vijay,<br></div>I think the dev.tech.network mailing list will be more likely to get answers from knowledgeable people. See <a href="https://www.mozilla.org/en-US/about/forums/#dev-tech-network">https://www.mozilla.org/en-US/about/forums/#dev-tech-network</a> for more information.<br><br>Cheers,<br>Josh<br></div><div class="gmail_extra"><br><div class="gmail_quote">On 8 October 2014 17:05, Vijith Vayanippetta <span dir="ltr"><<a href="mailto:Vijith_Vayanippetta@infosys.com" target="_blank">Vijith_Vayanippetta@infosys.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Folks<br>
<br>
Can you please help on this thread?<br>
<br>
Regards<br>
Vijith<br>
________________________________<br>
From: Vijay Vishvas Dharap<br>
Sent: Thursday, September 25, 2014 3:09 PM<br>
To: <a href="mailto:firefox-dev@mozilla.org">firefox-dev@mozilla.org</a><br>
Cc: Vijith Vayanippetta<br>
Subject: Ajax cross-domain 302 response should be followed or not?<br>
<span class=""><br>
Hello,<br>
<br>
I would like to understand if following is a valid firefox behavior or I am missing something.<br>
<br>
First user action<br>
<br>
1. User requests <a href="http://domainA.com/login" target="_blank">http://domainA.com/login</a><br>
<br>
2. domainA serves Login page from <a href="http://domainA.com" target="_blank">http://domainA.com</a><br>
<br>
3. User POST the login credentials to <a href="http://domainB.com" target="_blank">http://domainB.com</a> via Ajax request. CORS is turned on by making xhr.withCredentials = true.<br>
<br>
4. domainB.com is configured to response to CORS requests from domainA.com.<br>
<br>
5. A successful response is achieved (200). Cookie is set for domainB.com<br>
<br>
Followup action by the user<br>
<br>
6. Now user manually initiates Ajax request to another resources in domainA.<br>
<br>
7. domainA returns a 302 for a “loginValidation” resource on domainA itself.<br>
<br>
8. Firefox transparently follows 302 to loginValidation resource.<br>
<br>
9. As a response domainA/loginValidation responds with another 302 but this time to a loginValidation resource on domainB.<br>
<br>
10. Firefox does NOT follow this 302.<br>
<br>
In this whole process, the cross domain headers were present only for the first request.<br>
<br>
How do I make the firefox follow the 302 in 10th step? Any ideas?<br>
<br>
</span>I have tried to make sense out of MDN CORS Material<<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS</a>> as well as CORS Spec<<a href="http://www.w3.org/TR/cors/" target="_blank">http://www.w3.org/TR/cors/</a>>. But I could not get specific confirmation on this behavior / help on changing the behavior.<br>
<span class=""><br>
<br>
Regards,<br>
Vijay Dharap<br>
Sr Tech Arch @ MFGD | Pune<br>
</span>Maven Nexus @ Infosys<<a href="http://vblrqtools-32.ad.infosys.com/nexus" target="_blank">http://vblrqtools-32.ad.infosys.com/nexus</a>> | Git Server @ Infosys<<a href="http://punitp121866d.ad.infosys.com/blit/" target="_blank">http://punitp121866d.ad.infosys.com/blit/</a>><br>
<span class=""><br>
<br>
**************** CAUTION - Disclaimer *****************<br>
This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely<br>
for the use of the addressee(s). If you are not the intended recipient, please<br>
notify the sender by e-mail and delete the original message. Further, you are not<br>
to copy, disclose, or distribute this e-mail or its contents to any other person and<br>
any such actions are unlawful. This e-mail may contain viruses. Infosys has taken<br>
every reasonable precaution to minimize this risk, but is not liable for any damage<br>
you may sustain as a result of any virus in this e-mail. You should carry out your<br>
own virus checks before opening the e-mail or attachment. Infosys reserves the<br>
right to monitor and review the content of all messages sent to or from this e-mail<br>
address. Messages sent to or from this e-mail address may be stored on the<br>
Infosys e-mail system.<br>
***INFOSYS******** End of Disclaimer ********INFOSYS***<br>
</span>_______________________________________________<br>
firefox-dev mailing list<br>
<a href="mailto:firefox-dev@mozilla.org">firefox-dev@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/firefox-dev" target="_blank">https://mail.mozilla.org/listinfo/firefox-dev</a><br>
</blockquote></div><br></div>