I found an issue in AngularJS that help me to move forward.
It seems that "Access-Control-Allow-Credentials" : true
was not set on the client side.
Instruction $httpProvider.defaults.withCredentials = true
was ignored.
I replace $resource call by a simple $http call with {withCredentials:true} in the config parameter.