Setting cookies in WP REST API requests

Question

I'm trying to use setcookie inside a WP REST request, but it isn't working. The REST request runs properly and performs it's other duties well, but it doesn't set any cookies.

Here's my example code, which is running on mywebsite.com

add_action( 'rest_api_init', function () {
    register_rest_route( 'my_auth/v1', '/auth_login', array(
        'methods' => array('POST'),
        'callback' => 'auth_login',
    ));

});


function auth_login( WP_REST_Request $request ) {
    update_post_meta(1234, 'test_field', 'test_value'); // this works!
    setcookie('auth_token', 'test1234', time()+3600, "/", 'mywebsite.com'); // this doesn't work
    return 'test';
}

If I send an AJAX request to my endpoint (mywebsite.com/wp-json/my_auth/v1/auth_login), the update_post_meta call works fine, but the setcookie call does not. I have tested this by visiting mywebsite.com after a request, which has no cookies set.

Answer 1

Adding this line to my $.ajax call fixed the problem for me.

$.ajax({
    xhrFields: { withCredentials: true },
    // the rest...

Sidenote: this requires the following header to be set on the server-side, which is enabled by default with the REST API (it seems).

Access-Control-Allow-Credentials:true

Answer 2

You need to add the following line to your ajax call:

xhrFields: { withCredentials: true }