{"action":"created","issue":{"url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/104","labels_url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/104/labels{/name}","comments_url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/104/comments","events_url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/104/events","html_url":"https://github.com/RusticiSoftware/TinCanJS/issues/104","id":55750983,"number":104,"title":"withCredentials() on Cross-Origin-Calls","user":{"login":"nob13","id":518109,"avatar_url":"https://avatars.githubusercontent.com/u/518109?v=3","gravatar_id":"","url":"https://api.github.com/users/nob13","html_url":"https://github.com/nob13","followers_url":"https://api.github.com/users/nob13/followers","following_url":"https://api.github.com/users/nob13/following{/other_user}","gists_url":"https://api.github.com/users/nob13/gists{/gist_id}","starred_url":"https://api.github.com/users/nob13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nob13/subscriptions","organizations_url":"https://api.github.com/users/nob13/orgs","repos_url":"https://api.github.com/users/nob13/repos","events_url":"https://api.github.com/users/nob13/events{/privacy}","received_events_url":"https://api.github.com/users/nob13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-28T12:35:43Z","updated_at":"2015-02-06T12:53:49Z","closed_at":null,"body":"Hello,\r\n\r\nwe are working on a learning platform based upon TinCan. Most course suppliers are using the Rustici-Tincan-Library and we like it. The course storage is on a different domain than the LRS-Endpoint. However we would like our users to be authenticated at the LRS in order to check if users are allowed to send this specific Tincan-Statement.\r\n\r\nIn our case Authentication is done via Cookies. Now we have the problem, that the TinCan-Calls do not contain any cookies at all. As they are Cross-Origin-Calls (CORS-Headers are all set) they need to have 'withCredentials' set inside the XMLHttpRequest object, otherwise cookies won't be send. Interestingly TinCanJS looks for this specific attribute and sets `env.hasCORS` to `true` but this gets not evaluated...\r\n\r\nIs it planned to call withCredentials() in the future?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/comments/73232138","html_url":"https://github.com/RusticiSoftware/TinCanJS/issues/104#issuecomment-73232138","issue_url":"https://api.github.com/repos/RusticiSoftware/TinCanJS/issues/104","id":73232138,"user":{"login":"nob13","id":518109,"avatar_url":"https://avatars.githubusercontent.com/u/518109?v=3","gravatar_id":"","url":"https://api.github.com/users/nob13","html_url":"https://github.com/nob13","followers_url":"https://api.github.com/users/nob13/followers","following_url":"https://api.github.com/users/nob13/following{/other_user}","gists_url":"https://api.github.com/users/nob13/gists{/gist_id}","starred_url":"https://api.github.com/users/nob13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nob13/subscriptions","organizations_url":"https://api.github.com/users/nob13/orgs","repos_url":"https://api.github.com/users/nob13/repos","events_url":"https://api.github.com/users/nob13/events{/privacy}","received_events_url":"https://api.github.com/users/nob13/received_events","type":"User","site_admin":false},"created_at":"2015-02-06T12:53:49Z","updated_at":"2015-02-06T12:53:49Z","body":"Thanks for your response. I am also not sure if it would be making sense in activating this flag by default inside the TinCan-Library because it may imply other problems or raise security concerns. \r\n\r\nAnyway, we circumvented the problem now with putting the LRS and the Course Storage behind the same reverse proxy thus making them visible by being served from the same domain and disabling CORS entirely. \r\n\r\nI just wanted to make sure if there isn't not another \"hidden\" configuration option we could use ;)"}}