title: Chrome CORS request sending two cookies with the same name
body: <p>I'm in the middle of migrating an older perl app with a newer PHP version, based on Laravel. This requires the perl app to make XHR requests to the new Laravel app, and I'm having some trouble in Chrome with the cookies being returned.</p>
  
  <p>When already logged in to both apps, I'm attempting to make two requests to the Laravel app: the first requesting a CSRF token, the second using that token to make a POST request.</p>
  
  <p>I've configured CORS to the point where I am sending and receiving cookies fine, and the initial /token GET call works correctly (authenticates based on the cookie sent by the XHR request)</p>
  
  <p>The /token call then returns a Set-Cookie header (as expected) with a laravel_session cookie, but my issue is that the following POST request is sending two versions of the same cookie, and PHP seems to only be looking at the incorrect one and thus loading the wrong session and testing against the wrong CSRF token.</p>
  
  <p>Here are the details of all 3 requests - as you can see the final POST is sending two versions of the same cookie, with different values. (Line breaks added in cookie headers for clarity)</p>
  
  <p>This only occurs in Chrome, in Safari it seems to send the correct cookies and the CSRF token is validated correctly. Chrome version is 45.0.2454.101.</p>
  
  <p>Token Request Headers:</p>
  
  <pre><code>GET /token HTTP/1.1
  Host: laravel.domain.com
  Connection: keep-alive
  Accept: */ *
  Origin: https://perl.domain.com
  X-FirePHP-Version: 0.0.6
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
  Referer: https://perl.domain.com/original/page.html
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8
  Cookie: XSRF-TOKEN=eyJpdiI6Im5kSG02TVhsc08wUVZCZkd2WnZQa1E9PSIsInZhbHVlIjoiWFE0MXFBNlZIMnNXVHppXC9hN0dqNlJ2K1psUU9JZlFqTUdZZ3RJVmc0N1ZqV0MrVEczOGVFV0ExcDRDYmQxZDBTbFhGaWFiUkh5TGowOUgxdzVKOCtBPT0iLCJtYWMiOiJhOTYzNDFlZjUyYTdjMWFmMDE1MTFlMjczYTA0NTE2NThlYjVlNTkyOWUyZWNjZWM1MGYxODc4MmVjMTM5YTFhIn0%3D;
  laravel_session=eyJpdiI6ImdSM0VTT25FUzZoY3JOeVwvN2JLWFFnPT0iLCJ2YWx1ZSI6Ilp3WHBFZlNuTnZibVMyMUlvbk1YM1YwdXF5VjRnTW1CNWVjUU1ReXlLZldSeEJxeTJFSmgyN2pyTjAydXlzMzE1TmJseWZrQmRraStDUkFqNTFReUp3PT0iLCJtYWMiOiI5MWMxM2YyNzFjOTY3ZjIxMmVjYmNlZWNlNDAzYjI2MjZkNmJhMzIyM2VlNTAwNGJlNTQ4OTU4OTMxZjJhYjE5In0%3D;
  _ga=GA1.3.1924987937.1443461035;
  _dc_gtm_UA-5119192-1=1
  </code></pre>
  
  <p>Token Response Headers:</p>
  
  <pre><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Origin:https://perl.domain.com
  Cache-Control:no-cache
  Connection:Keep-Alive
  Content-Length:40
  Content-Type:text/plain; charset=UTF-8
  Date:Mon, 28 Sep 2015 17:24:18 GMT
  Keep-Alive:timeout=2, max=80
  P3P:policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
  Server:Apache
  Set-Cookie:XSRF-TOKEN=eyJpdiI6ImFiT3ZSWWVDUnlKcWMraGFrWnBVY2c9PSIsInZhbHVlIjoiOTVnc05UM3puVGRwTUNUbDl3T1FNTVpWdGxVM29VaHNLSUt0XC9LTkhzMG5iOGlNbmhHXC9KMDBBTW9qRjZFQXZaSmlHTmhKUVpmTGdpXC80K0lkSUhUdnc9PSIsIm1hYyI6IjI5Njc1ZWE2NTRiYTY4NWJhMmE5Y2UwNjBlZDRkOWE4OGQwOWQ5NjE1YjAyNTMwNTFmZDczY2RjNzRiNjExNDIifQ%3D%3D; expires=Mon, 28-Sep-2015 19:24:23 GMT; Max-Age=7200; path=/
  Set-Cookie:laravel_session=eyJpdiI6IjJqbTRyWG1GOEd1c2NIRnd4eE4yMGc9PSIsInZhbHVlIjoiZzk2SFE2emxcL0xGNjI3aGtYd1NmWURUVEduMVZVY2dYeUlRTVo2UTYyU0I2dFljalhxTjJSY3JFMGpvXC9nc2N0N3dJUFZYbGQya3pUNit1eWtrM3JqZz09IiwibWFjIjoiNDBhYzAzZjkwNDA5ZDE4Y2Y5ZjQ1MjdiYTUwYWU2M2Y5NjVjY2I1ZmMxZWFlMzAwZWM4MmVjNWRlYjM2Yjc2ZSJ9; expires=Mon, 28-Sep-2015 19:24:23 GMT; Max-Age=7200; path=/; httponly
  Vary:Origin
  X-Powered-By:PHP/5.5.9-1ubuntu4.11
  </code></pre>
  
  <p>Preflight Request Headers:</p>
  
  <pre><code>OPTIONS /destination/of/post HTTP/1.1
  Host: laravel.domain.com
  Connection: keep-alive
  Access-Control-Request-Method: POST
  Origin: https://perl.domain.com
  X-FirePHP-Version: 0.0.6
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
  Access-Control-Request-Headers: accept, content-type
  Accept: */*
  Referer: https://perl.domain.com/original/page.html
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8
  </code></pre>
  
  <p>Preflight Response Headers:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Mon, 28 Sep 2015 17:24:24 GMT
  Server: Apache
  X-Powered-By: PHP/5.5.9-1ubuntu4.11
  Allow: POST
  Cache-Control: no-cache, private
  access-control-allow-credentials: true
  access-control-allow-origin: https://www.readytoship.com.au
  access-control-allow-methods: GET, POST, PUT, DELETE
  access-control-allow-headers: ACCEPT, CONTENT-TYPE
  Set-Cookie: XSRF-TOKEN=eyJpdiI6ImVRTGM3Q1I5RUttXC83NlVLNEN3Z3ZRPT0iLCJ2YWx1ZSI6IlE0SVRjVnJHRHhRUXFYYUhZbVwvSEpLSFp2VVZSa0creW5OUzR2aFdXTEI5VWFEMzBCSkNjeHBzR0dycjVuYWxsOVJ4KzdNVWhhR3dMSmhiam8yUDZcL1E9PSIsIm1hYyI6ImRiYzE4ODRlMTAyOTFkMmY0NTI2YjkzMmExMGZjM2EzOTU2ZDc3N2Q1ZGQzYjNhM2EyNDY5YjhjNGIxMjVlMWYifQ%3D%3D; expires=Mon, 28-Sep-2015 19:24:24 GMT; Max-Age=7200; path=/
  Set-Cookie: laravel_session=eyJpdiI6InR5M3JjWkltaVdoSldIa3FsWVp2YUE9PSIsInZhbHVlIjoibjFuODdiVXRKQmdvU1hVcTdcL3VQeWF4K243d2h3Z3EwNWtVeTNWZUdBWGFWQ21QQXlid2RFSmNLSklpanVpZUNhZGE5UlU2Q1FqUCtnSVd4UWkwM2ZRPT0iLCJtYWMiOiI1ZjNjOWQyNmZlNGI1MDI5OGQxOGY2ZGI5M2M1MTMwNWRjZGY4MDVjMGViODNjYjg0MmU5ZWQ0MzRjNjYyN2VhIn0%3D; expires=Mon, 28-Sep-2015 19:24:24 GMT; Max-Age=7200; path=/; httponly
  Vary: Accept-Encoding
  Content-Encoding: gzip
  P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
  Content-Length: 3501
  Keep-Alive: timeout=2, max=80
  Connection: Keep-Alive
  Content-Type: text/html; charset=UTF-8
  </code></pre>
  
  <p>POST Request Headers:</p>
  
  <pre><code>POST /destination/of/post HTTP/1.1
  Host: laravel.domain.com
  Connection: keep-alive
  Content-Length: 72
  Accept: application/json, text/javascript, */ *; q=0.01
  Origin: https://perl.domain.com
  X-FirePHP-Version: 0.0.6
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
  Content-Type: application/json
  Referer: https://perl.domain.com/original/page.html
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.8
  Cookie: _dc_gtm_UA-5119192-1=1; _ga=GA1.3.2141864485.1441288526;
  __zlcmid=WXevTAW8aGLGrO; 
  XSRF-TOKEN=eyJpdiI6ImQ1TFRGaWFwK3cyd3RRa3BzbUNmc0E9PSIsInZhbHVlIjoiNGEydmlLWE96NzZueWtaWWlUa3UzMjZOK29NbmNPb2VidVdVYzdSbkZsaWJMVmxBRitLT05oK3hodUc1ejRMOWJWYzVIeEl6UlpzQ0dIeWlob3pFOFE9PSIsIm1hYyI6IjkzNTczMDJlOWVhZjM5NTU0NGEyNmE5YWNiODcxNDk4YmE0ODEyYTE3ZWExODBiMmNhNDFmMGFhMjVmNjhhYjgifQ%3D%3D;
  laravel_session=eyJpdiI6IkIrc3QzUk1iQnNEKysxOEg2UCtSbmc9PSIsInZhbHVlIjoiYXVDalVhaUpDMms3K3AwZFVLV0EyMDMwK25tVUQyYWw5c1MxTVRkZ0ZvVWpcL2lZUndubitsQ2VVMDF1UFcwNzNsR1doNG9TY2diMEhadHdXMEoxamt3PT0iLCJtYWMiOiI5MjE1NWE0MGNmMDgyYzhlYjBjMDUwY2JhOGYxNThjZTM0MjMwM2E3M2VjZjg1ZTgxMzIxZjE5OTkzZDEzZDhhIn0%3D;
  _ga=GA1.3.1924987937.1443461035;
  _dc_gtm_UA-5119192-1=1;
  XSRF-TOKEN=eyJpdiI6ImFiT3ZSWWVDUnlKcWMraGFrWnBVY2c9PSIsInZhbHVlIjoiOTVnc05UM3puVGRwTUNUbDl3T1FNTVpWdGxVM29VaHNLSUt0XC9LTkhzMG5iOGlNbmhHXC9KMDBBTW9qRjZFQXZaSmlHTmhKUVpmTGdpXC80K0lkSUhUdnc9PSIsIm1hYyI6IjI5Njc1ZWE2NTRiYTY4NWJhMmE5Y2UwNjBlZDRkOWE4OGQwOWQ5NjE1YjAyNTMwNTFmZDczY2RjNzRiNjExNDIifQ%3D%3D;
  laravel_session=eyJpdiI6IjJqbTRyWG1GOEd1c2NIRnd4eE4yMGc9PSIsInZhbHVlIjoiZzk2SFE2emxcL0xGNjI3aGtYd1NmWURUVEduMVZVY2dYeUlRTVo2UTYyU0I2dFljalhxTjJSY3JFMGpvXC9nc2N0N3dJUFZYbGQya3pUNit1eWtrM3JqZz09IiwibWFjIjoiNDBhYzAzZjkwNDA5ZDE4Y2Y5ZjQ1MjdiYTUwYWU2M2Y5NjVjY2I1ZmMxZWFlMzAwZWM4MmVjNWRlYjM2Yjc2ZSJ9
  </code></pre>
  
  <p>POST Response Headers</p>
  
  <pre><code>HTTP/1.0 302 Found
  Date: Mon, 28 Sep 2015 17:24:24 GMT
  Server: Apache
  X-Powered-By: PHP/5.5.9-1ubuntu4.11
  Cache-Control: no-cache
  Location: https://laravel.domain.com/auth/login
  P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
  Content-Length: 416
  Connection: close
  Content-Type: text/html
  </code></pre>