CORS intranet (http) to internet (https), what are my options?

Question

I have JS, which is located in an intranet application running over HTTP (this server / service is not in my control, it is executed by the client). I am managing an Internet application and it must run on HTTPS for security reasons.

I am trying to use XDomain , but I found that cookies are not sent. Is it a problem that I am going to an intranet on the Internet or that I am going to HTTP on HTTPS or some configuration problems?

I keep getting 401 on user authentication even after they are logged in.

I have confirmed that the backend / internet service works as expected through jsfiddle (i.e. Access-Control-Allow-Origin etc. everything is correct).

Thanks!

Answer 1

There are some security issues in XDomain that block any cookies as per # 5 in this msdn blog . However, there is also a workaround using a proxy server with a sample Github project . I think that everything you need to get it working is described on these two pages.