Axios has no cross-domain settings withCredentials is invalid?

problem description

The

code is as follows, with withCredentials

set

check the stack in res of axios on the first layer.
finds that JSSESIONID and Path are / authcas/

in the set-cookie attribute of res.headers .

but in the res.headers of the second and third layers, it is found that the set-cookie property is constantly set, and the res.request._header finds that the request does not carry cookie at all

.

it is true that there is no cross-domain and Path path miscorrespondence in Cookie after checking, and there is no problem in PostMan and JavaHttpClient testing.
should have been carried on the Cookie but not on it. What is the problem? Thank you

function getCaptcha(username, password) {
    const map = new Map;
    map.set("password", password)

    const axios = Axios.create({
        headers: {
            "X-Requested-With": "XMLHttpRequest"
        },
        baseURL: "https://xxxx.xxxx.edu.cn",
        withCredentials: true
    })
    axios
        .get("/authcas/getCaptcha?service=http://xxxxxx.action")
        .then(res => {
            const body = res.data
            const ltLabel = body.match(/<input\s+type="hidden"\s+name="lt"\s+id="lt"\s+value="([a-zA-Z0-9.\-]+)"\s+\/>/)
            if (ltLabel.length >= 2) map.set("lt", ltLabel[1])
            else throw new Error()

            const exeLabal = body.match(/<input\s+type="hidden"\s+name="execution"\s+id="execution"\s+value="(\w+)"\s+\/>/)
            if (exeLabal.length >= 2) map.set("execution", exeLabal[1])
            else throw new Error()

            Axios
                .all([
                    axios.get(`/authcas/security/evaluate?userId=${username}`),
                    axios.get("/authcas/captcha")
                ])
                .then(() => {
                    const t = Math.random()
                    Axios
                        .all([
                            axios.get(`/authcas/captcha/master?${t}`),
                            axios.get(`/authcas/captcha/sub?${t}`)
                        ])
                        .then((res) => {
                            debugger
                        })
                        .catch(err => {
                            debugger
                        })
                })
                .catch(err => {
                    debugger
                })
        })
        .catch((err) => {
            console.error(err)
        })

}
Apr.12,2022

backend Access-Control-Allow-Origin to see whether the specified domain name is set

Menu