title: JSessionId (httponly cookie) not sent to web service from Javascript
body: <p>We have a web applet that loads under the URL <a href="https://secure-ausomxeja.crmondemand.com/OnDemand/" rel="nofollow">https://secure-ausomxeja.crmondemand.com/OnDemand/</a>... from where we are making a web service call within the same domain (https://secure-ausomxeja.crmondemand.com/Services/Integration) using JQuery. We are not able to understand the fact that JSessionId (a httponly cookie) is not getting passed in the JQuery web service call even though everything is happening in the same domain. Interestingly, if the web service URL would start with <a href="https://secure-ausomxeja.crmondemand.com/OnDemand/" rel="nofollow">https://secure-ausomxeja.crmondemand.com/OnDemand/</a>... (though is not correct), the browser properly passes the cookie.</p>
  
  <p>The question is, for a httponly cookie to be sent back to the server, is it sufficient to have the same domain or even the name of the first directory (OnDemand in our case) is also required?</p>
  
  <p>Below is the code snippet that does not pass the JSessionId cookie-</p>
  
  <pre><code>$.ajax({
  url:"https://secure-ausomxeja.crmondemand.com/Services/Integration",
  type: "POST",
  dataType: "xml",
  data: ...,
  beforeSend: function(xhr) { xhr.setRequestHeader("SOAPAction", "..."); },
  complete: endSaveProduct,
  contentType: "text/xml; charset=\"utf-8\""
  });
  </code></pre>
  
  <p>Below is the code snippet that does pass the JSessionId cookie (but doesn't make sense as there is no web service available at that location) - </p>
  
  <pre><code>$.ajax({
  url:"https://secure-ausomxeja.crmondemand.com/OnDemand/...",
  type: "POST",
  dataType: "xml",
  data: ...,
  beforeSend: function(xhr) { xhr.setRequestHeader("SOAPAction", "..."); },
  complete: endSaveProduct,
  contentType: "text/xml; charset=\"utf-8\""
  });
  </code></pre>