必须通过将“ withCredentials”设置设置为true来发出AJAX请求（仅在XmlHttpRequest2和fetch中可用）：
var req = new XMLHttpRequest(); req.open('GET', 'https://api.bobank.com/accounts', true); // force XMLHttpRequest2 req.setRequestHeader('Content-Type', 'application/json; charset=utf-8'); req.setRequestHeader('Accept', 'application/json'); req.withCredentials = true; // pass along cookies req.onload = function() { // store token and redirect let json; try { json = JSON.parse(req.responseText); } catch (error) { return reject(error); } resolve(json); }; req.onerror = reject;如果您需要有关CORS，API安全性和cookie的详细说明，则该答案不适合StackOverflow注释。看看我写的这篇文章：http : //www.redotheweb.com/2015/11/09/api-
security.html
