# WebExtension: XMLHttpRequest issues: No cookies or referrer \*SOLVED\*

**URL:** <https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224>\
**Category:** Development\
**Created:** [October 2, 2016, 3:48am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224 "2016-10-02T03:48:31Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 2, 2016, 3:48am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/1 "2016-10-02T03:48:31Z")

</div>

Hello!  
I’m converting chrome extension to WebExtension. I have everything working except XMLHttpRequest. FF is not sending cookies or referrer (same domain). I’m guessing the cause is Xray? And is this the reason that relative urls for XMLHttpRequest fails because FF considers the content script to be its own domain?

I can work around this by writing a script to the page with createElement(“script”), append to head and using a href=“javascript:runThisFunction();” on a link. I know this is not the way it should be done. I have looked at [this page](https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Content_scripts#Sharing_content_script_objects_with_page_scripts). Does this apply in my case?

I’m in need of some guidance on the proper way to implement XMLHttpRequest with credentials for same domain requests. For now, I’m stuck. I’ll provide code on request.  
Thanks in advance for any help given!

NOTE: My usage of “same domain” means sending a request to the same domain/page that the content script is loaded. If that wasn’t already clear… 😉

---

<div class="post-metadata">

**Author:** ![noitidart](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@noitidart](https://discourse.mozilla.org/u/noitidart)\
**Post date:** [October 2, 2016, 10:46am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/2 "2016-10-02T10:46:11Z")

</div>

Whoa this is interesting.

Are you doing the XHR from inside a content script on a page?

Or are you doing the XHR from the background page?

Either way I would expect the cookies to be there. I haven’t got to the XHR steps of my addon, does anyone know if cookies are available to XHR from background script, from content script? Does it need special permission in manifest.json?

(knowing when to give permission, and with what entry in the manifest, is a hard thing to find out, the only way I figure out is when I hit an unexpected block, I troubleshoot randomly and it usually ends up with some new key in the manifest)

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 2, 2016, 11:08am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/3 "2016-10-02T11:08:28Z")

</div>

Thanks for the interest noitidart. XHR from a content script. No background script loaded.  
I too wonder if it is permission or manifest related. For the heck of it, I put “webNavigation” and “webRequest” in permissions with no joy. The “no cookie” is a killer for me, since my addon is site specific and without cookies, the site returns the login page (assumes logged out). I really hope someone has some info about this…

---

<div class="post-metadata">

**Author:** ![noitidart](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@noitidart](https://discourse.mozilla.org/u/noitidart)\
**Post date:** [October 2, 2016, 11:12am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/4 "2016-10-02T11:12:58Z")

</div>

Try putting in `<all_urls>` it has fixed a lot of my problems. No idea why.

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 2, 2016, 11:23am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/5 "2016-10-02T11:23:56Z")

</div>

Sure, I’ll try.  
No joy with `<all_urls>` set for content scripts and also permissions…

---

<div class="post-metadata">

**Author:** ![freaktechnik](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/freaktechnik/32/37766_2.png) [@freaktechnik](https://discourse.mozilla.org/u/freaktechnik)\
**Post date:** [October 2, 2016, 2:21pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/6 "2016-10-02T14:21:09Z")

</div>

Yes, you get the extension’s XMLHttpRequest and fetch within a content script. To get the one from the page, use `window.wrappedJSObject.XMLHttpRequest`, which then returns the version from the page, since `wrappedJSObject` waives the wrappers.

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 2, 2016, 5:00pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/7 "2016-10-02T17:00:37Z")

</div>

Thank you freaktechnik, for some hope!  
Sadly, wrapping is new to me and I am quite cloudy regarding its usage. I tried many failed variations. The following is the code I’m using. All the commented lines are my failed attempts. The first commented line resulted in “Error: Permission denied to access object”. I did not record the errors for the other lines. I just know they did not work.

```
function loadXMLDoc(url, isXML, cfunc) {
   console.log("Sending Request to "+url);
   isWorking=true;
   http=new XMLHttpRequest();
// http=new window.wrappedJSObject.XMLHttpRequest();
// http=window.wrappedJSObject.new XMLHttpRequest();
// http=window.wrappedJSObject(new XMLHttpRequest());
// http=new content.wrappedJSObject.XMLHttpRequest();
// var htt=new XMLHttpRequest();
// http=content.wrappedJSObject.htt;
// http=content.wrappedJSObject.(new XMLHttpRequest());
// http=new XMLHttpRequest().wrappedJSObject;
// http=window.wrappedJSObject;
// http=window.wrappedJSObject.http;
   if(isXML){http.responseType="document";}
   http.onreadystatechange=cfunc;
   http.open("GET", url, true);
   http.withCredentials = true;
   http.send(null);
}

```

Will you please expand a bit on what I need to do? Or point me to a good reference webpage? It really bothers me that I just “don’t get it”…

---

<div class="post-metadata">

**Author:** ![freaktechnik](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/freaktechnik/32/37766_2.png) [@freaktechnik](https://discourse.mozilla.org/u/freaktechnik)\
**Post date:** [October 2, 2016, 5:10pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/8 "2016-10-02T17:10:43Z")

</div>

As far as I understand it should be

```auto
const http = new XPCNativeWrapper(window.wrappedJSObject.XMLHttpRequest)();

```

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 2, 2016, 5:34pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/9 "2016-10-02T17:34:00Z")

</div>

Thank you! Well, it didn’t work as posted, but the following DID work!  
Cookies and referrer sent confirmed. 😌

`http = XPCNativeWrapper(new window.wrappedJSObject.XMLHttpRequest());`

I will research this some more.  
Thank you so much for the help! 🙂

---

<div class="post-metadata">

**Author:** ![noitidart](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@noitidart](https://discourse.mozilla.org/u/noitidart)\
**Post date:** [October 3, 2016, 3:13pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/10 "2016-10-03T15:13:01Z")

</div>

Is this `XPCNativeWrapper` thing same in Google Chrome and other browsers? How would we use cookies there? Can background script use cookies?

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 3, 2016, 8:33pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/11 "2016-10-03T20:33:06Z")

</div>

I don’t have any issues with normal XHR in Chrome. It sends cookies no  
problem. It is only in FF that I need to wrap. Since I use the same content  
script for both browsers, I just simply grab the correct object as needed…

```
function getXMLHttp(){
   try {
      return XPCNativeWrapper(new window.wrappedJSObject.XMLHttpRequest());
   }
   catch(evt){
      return new XMLHttpRequest();
   }
}

```

I’m sure there is a better method than try/catch but for now, this works  
perfectly and the same code works in Chrome and FF.

---

<div class="post-metadata">

**Author:** ![freaktechnik](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/freaktechnik/32/37766_2.png) [@freaktechnik](https://discourse.mozilla.org/u/freaktechnik)\
**Post date:** [October 5, 2016, 9:29am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/12 "2016-10-05T09:29:47Z")

</div>

I’m told setting [https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials) could also solve your issue, as your request is treated as Cross-Origin and thus the property will dedault to false. This should work without the unwrapping & rewrapping.

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 5, 2016, 9:46am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/13 "2016-10-05T09:46:29Z")

</div>

Thank you. It’s a good idea, but it does not work.  
I had already set withCredentials to true in all my previous testing. EDIT: See my failed code above.  
No cookies or referrer were sent until I wrapped it (thanks to you).

EDIT:  
Unwrapped: Relative URLs would fail as “invalid” string. Request not sent.  
Unwrapped: Full URL would send, but no cookie or referrer sent (withCredentials=true ).  
Wrapped: Everything normal…

---

<div class="post-metadata">

**Author:** ![matt](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@matt](https://discourse.mozilla.org/u/matt)\
**Post date:** [October 20, 2016, 7:45pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/14 "2016-10-20T19:45:06Z")

</div>

You can avoid this by enabling 3rd-party cookies. Firefox disabled this by default many releases ago, and it broke many extensions that made XHR requests back to the site where the extension was running. I complained long ago, and said that extensions should be exempt from 3rd-party-cookie blocking, but apparently they decided not to do that.

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [October 21, 2016, 8:57am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/15 "2016-10-21T08:57:44Z")

</div>

Thanks, that is quite interesting… I did a quick test and you are correct. I enabled third-party cookies in FF and requests are sent correctly. But… relative URLs did not work. It must be the full URL.

I have always disabled third party cookies for as long as I can remember. I am sure I am not the only one… 😉 And if FF now disables third-party cookies by default, this means even more users that I am concerned about. Wrapping is working well for me. And I don’t need to tell users to enable third-party cookies in order for the extension to work. I’m quite sure you weren’t suggesting that. lol

Regardless, this is interesting info and good to know. I appreciate it. 🙂  
Would you happen to have links to any conversations about your complaint?

---

<div class="post-metadata">

**Author:** ![noitidart](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@noitidart](https://discourse.mozilla.org/u/noitidart)\
**Post date:** [January 22, 2017, 11:08pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/16 "2017-01-22T23:08:00Z")

</div>

> [@SubDevo](#):
>
> Would you happen to have links to any conversations about your complaint?

Here’s a bug SubDevo - [https://bugzilla.mozilla.org/show\_bug.cgi?id=1322113](https://bugzilla.mozilla.org/show_bug.cgi?id=1322113)

---

<div class="post-metadata">

**Author:** ![edcaron](https://avatars.discourse-cdn.com/v4/letter/e/67e7ee/32.png) [@edcaron](https://discourse.mozilla.org/u/edcaron)\
**Post date:** [September 11, 2017, 7:21pm UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/17 "2017-09-11T19:21:17Z")

</div>

so, did you manage to do this? I’m also stuck on this issue and i’d like to know

---

<div class="post-metadata">

**Author:** ![SubDevo](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/subdevo/32/5566_2.png) [@SubDevo](https://discourse.mozilla.org/u/SubDevo)\
**Post date:** [September 15, 2017, 2:12am UTC](https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/18 "2017-09-15T02:12:56Z")

</div>

Yes. In my add-on, I’m using what I posted earlier.  
Same code for FF and Chrome version.

> [@SubDevo](#):
>
> ```
> function getXMLHttp(){
> try {
> return XPCNativeWrapper(new window.wrappedJSObject.XMLHttpRequest());
> }
> catch(evt){
> return new XMLHttpRequest();
> }
> }
> 
> ```

I just grab the correct object (for chrome or firefox) by calling the above function and use in place of XMLHttpRequest.

For example:

```
   var http=getXMLHttp();
   http.onreadystatechange=someFunction();
   http.open("GET", url, true);
   http.send(null);

```