# XMLHttpRequest does not contain cookies, when third party cookies are disabled in preferences

**URL:** <https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072>\
**Category:** Development\
**Created:** [August 14, 2017, 6:44pm UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072 "2017-08-14T18:44:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mstanke](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mstanke/32/34652_2.png) [@mstanke](https://discourse.mozilla.org/u/mstanke)\
**Post date:** [August 14, 2017, 6:44pm UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072/1 "2017-08-14T18:44:59Z")

</div>

Hi.

I wanted to port a WebExtension to Firefox and have noticed, that sent  
XMLHttpRequest fail with 401 error. Digging down a bit I have noticed,  
it happens only when 3rd party cookies are disabled in my  
about:preferences. Is it a bug, or intentional behaviour? If that’s  
intentional, how can I login a get a cookie in the extension?

---

<div class="post-metadata">

**Author:** ![NilkasG](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [August 14, 2017, 11:15pm UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072/2 "2017-08-14T23:15:59Z")

</div>

Do you have the corresponding host permission in your manifest?

also, setting this may help:

> **[XMLHttpRequest.withCredentials](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials)**
>
> The XMLHttpRequest.withCredentials property is a Boolean that indicates whether or not cross-site Access-Control requests should be made using credentials such as cookies, authorization headers or TLS client certificates. Setting withCredentials has...

---

<div class="post-metadata">

**Author:** ![mstanke](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mstanke/32/34652_2.png) [@mstanke](https://discourse.mozilla.org/u/mstanke)\
**Post date:** [August 15, 2017, 6:24am UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072/3 "2017-08-15T06:24:11Z")

</div>

Hi Niklas.

Yes, I do both. But it seems, Firefox takes all cookies as third party, when the request is made from the add-on.

---

<div class="post-metadata">

**Author:** ![NilkasG](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [August 15, 2017, 11:35am UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072/4 "2017-08-15T11:35:49Z")

</div>

It sounds like a bug then. I don’t think extensions should be affected by the cookie settings. I’m a bit surprised though, that this hasn’t come up before. You should look for a bug reporting this on bugzilla and file one if there is none.

---

<div class="post-metadata">

**Author:** ![mstanke](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mstanke/32/34652_2.png) [@mstanke](https://discourse.mozilla.org/u/mstanke)\
**Post date:** [August 16, 2017, 9:31am UTC](https://discourse.mozilla.org/t/xmlhttprequest-does-not-contain-cookies-when-third-party-cookies-are-disabled-in-preferences/18072/5 "2017-08-16T09:31:39Z")

</div>

Thank you @NilkasG for your assistance. I haven’t found any similar bug, so reported [here](https://bugzilla.mozilla.org/show_bug.cgi?id=1390798).