Request ajax does not declare Session

Question

I have a login system with Ajax+PHP with languages running on different servers. On the same server works perfectly, but in this mode, the request occurs but the Session is not declared (I need it to be declared only on the remote server, I don’t need to pass it to the local server, only from the pages generated by the remote server itself based on the Sesssions). Cors is authorized by Header Set Access-Control-Allow-Origin "*" (test character) and I believe it is working because when the password is incorrect, for example, it returns what it should, but does not declare the.

Request code for the server

<script>

$('document').ready(function(){
 
    $("#btn-login").click(function(){
        var data = $("#login-form").serialize();
        $.ajax({
            type : 'POST',
            url  : 'urldoservidorremoto/login.php',
            data : data,
            success :  function(response){                      
                if(response == "1"){    
                    $("#btn-login").html('Entrar');
                    $("#login-alert").css('display', 'none');
                    window.location.href = "login-confirma.html";
                }
                else{
                    $("#btn-login").html('Entrar');
                    $("#login-alert").css('display', 'block')
                    $("#mensagem").html('Email ou senha incorretos. Tente novamente!');
                }
            }
        });
    });
 
});

</script>

php code - Run remotely

<?php

include 'db.php';
 
$email = $_POST["email"];
$senha = sha1($_POST["senha"]);

//$verifica_user = mysql_query("SELECT * FROM usuarios WHERE usuario = '$usuario'");

$verifica_user = mysqli_query($mysqli, "SELECT * FROM usuarios WHERE email = '$email' and senha = '$senha' ");
$row = mysqli_num_rows($verifica_user);

if($row <= 0){
    session_start();
    unset($_SESSION['usuario']);
    unset($_SESSION['senha']);
                $retorno = '0';
}
else{
    while($row = $verifica_user->fetch_assoc()) {
            session_start();
                $_SESSION['email'] = $email;
                $_SESSION['nome'] = $row["nome"];
                $_SESSION['sobrenome'] = $row["sobrenome"];
                $_SESSION['nascimento'] = $row["nascimento"];
                $retorno = '1';
}
    
    $_SESSION['sair'] = 'Sair';
}
    echo $retorno;

?>

I also made a login.js run remotely to check if the person is logged in, this login.js runs remotely, I have released that it is generated by php in mysql.

<?php
session_start();
include 'db.php';
if(isset($_SESSION['email'])){
    $email = $_SESSION['email'];
    $verifica_user = mysqli_query($mysqli, "SELECT * FROM usuarios WHERE email = '$email'");
    $row = mysqli_num_rows($verifica_user);
    while($row = $verifica_user->fetch_assoc()) {
    $ativado = $row["contaativa"];
    $endereco = $row["endereco"];
    if($ativado==0){
    echo "var contaativa = 'inativo'; \n ";
    echo "var endereco = 'ativo'; \n ";
    echo "var logado = 'ativo'";
    }elseif($endereco==0){
    echo "var endereco = 'inativo'; \n ";
    echo "var contaativa = 'ativo'; \n ";
    echo "var logado = 'ativo'";

    }else{
    echo "var endereco = 'ativo'; \n ";
    echo "var contaativa = 'ativo'; \n ";
    echo "var logado = 'ativo'";
    }
    }
}else{
    echo "var logado = 'inativo'";
}
?>

This is the part that checks locally

<script type="text/javascript" src="urldoservidoremoto/js/login.js"></script>
<script>
if(logado == 'inativo'){
    window.location.href = 'login.html';
}
else if(contaativa == 'inativo'){
    window.location.href = 'ativarconta.html';
}else if(endereco == 'inativo'){
    window.location.href = 'configuraendereco.html';
}
</script>

Is there any way to free Session from running on the server and ajax returns are generated accordingly? Just to reiterate: On the local server, everything works normally.

Answer 1

Solved.

Inseri xhrFields: {withCredentials: true}, in the ajax request and Header Set Access Control-Allow-Credentials: true on my remote server . htaccess, not forgetting the Header Set Access-Control-Allow-Origin 'http://urldoservidor', that I had before.