Cookie Secure - API rest

luislopezlg2 years ago

11

• 

  martafiixek2 years ago

  So, what doesn't work?

• 

  luislopezlg2 years ago

  Cookie secure is supposed to be set automatically when I fetch to login Endpoint, but it's not set :/

• 

  martafiixek2 years ago

  You are making a fetch request to the auth endpoint from Next to Payload?

• 

  luislopezlg2 years ago

  Yes

• 

  jarrod_not_jared

  2 years ago

  are you using

  credentials: include
• 

  martafiixek2 years ago

  I replicated your issue to be honest

  
  
  

  What I tried was same as

  @629766588492677131

  did.

  
  
  

  I had problems even with just setting the cookie after successful login. Localhost acts as a same origin scenario, even with different ports, so there shouldn't be a problem.

  
  
  

  That is certain because when you login directly from the CMS, and then you will switch to your Next.js application, cookie will be shared. However when you want to login directly from the Next.js app, you will get a token back inside the response data, but the cookie itself will not be set

  
  
  

  Bear in mind please, that I tried this at 1:30 AM and I was tired already

  
  
  

  But I will try to take a look at it over the weekend

  
  
  

  Logout is similar scenario, cookie doesn't get deleted, setting

  credentials: include

  caused CORS error

  
  
  BUT

  I think the default behaviour is that accepting all origins with * asterisk and accepting credentials is forbidden

  
  
  https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
  
  

  Therefore try to set allowed origins to be

  localhost:5000

  or smth like that

• 

  jarrod_not_jared

  2 years ago

  Specifying the domains the cookie can be shared on is way more secure. I would always do that when you can

• 

  luislopezlg2 years ago

  I specified the domain and port and it worked ❤️

  
  

  Now the cookie is set correctly

  
  
  

  Thanks

  @217360281309806593

  and

  @281120856527077378
• 

  martafiixek2 years ago

  Does the logout work for you though?

• 

  luislopezlg2 years ago

  Yes, It works

  
  
  
• 

  .smalltalkman2 years ago

  the docs address cookie setting

  https://github.com/payloadcms/website