We re using JQuery AJAX to login. The login service issues a HTTP 302, with the location being the GET for the user logged in, or (in the case of a log in failure), a REST endpoint that always returns a not authorized HTTP status. At the same time as the 302, we issue a set cookie for the JSESSIONID. The cookie is a HttpOnly cookie.
When using a straight HTTP form post, the redirect works fine, and everything is set. When using JQuery AJAX, the redirect to the GET /user/{userId} doesn t work as the cookie is not sent with the second call. This failed second call should trigger yet another redirect to the auth-failed endpoint, but it actually doesn t. Inspecting it, I see that the second call gets "canceled". What does that mean, and how do I fix the problem in the first place?
