php - CORS - API Authentication : Sessions (CSRF Security) - Work Around? -

i using cors method (rewriting external requests example.com/api?param=args example.com/api/public/api.php?param=args) , sending request so:

$.get('http://www.example.com/api'), { param: "args" })     .done(function (data) {         alert(data);     }); 

this works absolutely fine , can cross-domain reference requests , responses api software.

i wondering, set test request try achieve session.

session_start(); if(isset($_get['store'])):     $_session['key'] = $_get['store']; elseif(isset($_get['show'])):     echo $_session['key']; endif; 

when go link directly in browser, works fine however, when send request external domain, second request seems "forget" session key stored.

code:

$.get('http://www.example.com/api'), { store: "test" })     .done(function () {         $.get('http://www.example.com/api'), { show: "args" })             .done(function (data) {                alert(data);         })     }); 

data undefined

is there way can make server sending requests "save" or "remember" session on api server or there way can achieve using work around?

note api used multiple people - plugin - , each key added once send register param request admin details of there account need sort of authentication using api , cannot think of way around not using session's or getting work using session's.

please note also, if using session (as can see that), creates crsf attack. there work around also?

by default, credentials (such cookies) not sent on cross-origin requests because trigger preflight requests.

the jquery documentation describes how enable credentials:

$.ajax({    url: a_cross_domain_url,    xhrfields: {       withcredentials: true    } }); 

cannot think of way around not using session's

pass auth token in body of response. read js. have js include in each request.

please note also, if using session (as can see that), creates crsf attack. there work around also?

don't use * origin in access-control-allow-origin header. allow trusted sites use api.