I got a undefined in each request in user header.

japineda162 years ago

28

• 

  notchr2 years ago

  @508788190472175629

  Good morning!

  
  
  

  - Are you sure that user.invoices.read is defined?

  
  
  

  - Are you sending your front end requests with

  credentials: include

  or the axios equivalent?

  
  
  

  - Is CORS / CSRF configured to allow non-localhost endpoints to receive requests?

• 

  japineda162 years ago

  Have I to send a header

  credentials: include

  ? And cors are configured in payload.config.ts as "*"

• 

  notchr2 years ago

  If you expect a cookie to be set automatically, the request needs to have "credentials: 'include'"

  
  
  

  or whatever axios uses

• 

  japineda162 years ago

  Adding credentials, now I get this issue

  
  
  

  Source:

  https://stackoverflow.com/questions/43002444/make-axios-send-cookies-in-its-requests-automatically
  
  

  I added CSRF, and didnt work

  
  
  @1049775120559898725

  last update, add to cors all domains which im using to development, but it doesn't work
• 

  allannnc2 years ago

  had similar issues before

  @508788190472175629

  , try this in

  server.ts
  
  

  app.use(
    cors({
            // https://stackoverflow.com/a/56189415
            // Normally, you can't do `cors: '*'` on the server and credentials: 'include' on the front end
            // But we want to allow this for development
            function (origin, callback) {
              return callback(null, true);
            },
      credentials: true,
    })
  );

  
  
  

  but make sure to set this conditionally for

  dev only

  , because it allows requests from any origin

• 

  jarrod_not_jared

  2 years ago

  @508788190472175629

  it is always better to be specific in your CORS/CSRF, I would remove the wildcards all together. You are setting cors/csrf in the payload config right?

• 

  japineda162 years ago

  Yes, I did, right know I remove * from payload.config.ts

  
  
  

  Let my try this, I'll keep you updated

• 

  jarrod_not_jared

  2 years ago

  oic, so you are not trying to login from a website, just your VSC Thunderbolt?

• 

  japineda162 years ago

  VSC Thunderbolt are working fine, but in NextJS not...

• 

  jarrod_not_jared

  2 years ago

  what port is your frontend served on?

• 

  japineda162 years ago

  I think is 3000, I dont remember as well right know, I have to check

  
  
  

  But I'm using the domain too in production

• 

  jarrod_not_jared

  2 years ago

  Right, one thing at a time I guess. Does it work locally? If not you will want to make sure that your frontend url i.e.

  http://localhost:3000

  is in your

  csrf

  array

• 

  japineda162 years ago

  Doesn't work locally too

  
  
  

  Locally, I'm working with nextJS using port 8080

  
  
  
• 

  jarrod_not_jared

  2 years ago

  ok and these ^ are in your payload config? And you restarted the payload server?

• 

  japineda162 years ago

  Yes

  
  
  

  I'm using pm2 as process manager

• 

  jarrod_not_jared

  2 years ago

  what does the request in your network panel look like

• 

  japineda162 years ago

  Here es payload response, when I try to receive the user through request

  
  read: ({ req: { user } }) => console.log(user)
• 

  jarrod_not_jared

  2 years ago

  Im talking in the browser, what does it look like. Open your inspector, look at the network tab and look for the login request (if that is the request you are making), screenshot that

• 

  japineda162 years ago

  This is an example of how axios config is setting up, including the headers

  
  
  

  Okok, let me take a screenshot

  
  
  

  Which option you want to see?
• 

  jarrod_not_jared

  2 years ago

  I think req/res headers

  
  
  

  Are you setting the Auth header on your axios request? You don't need that since we are using http-only cookies to auth

• 

  japineda162 years ago

  
  
  

  Yes, I setting up Auth header

  
  
  
• 

  jarrod_not_jared

  2 years ago

  ok the general would help too I guess

• 

  japineda162 years ago
• 

  jarrod_not_jared

  2 years ago

  Are you making a login request first?

• 

  japineda162 years ago

  Yes, I have a session

• 

  jarrod_not_jared

  2 years ago

  If you really want to use the token like that, use

  JWT

  instead of

  Bearer
  
  

  but normally what I do is make a login request - the cookie is created (since my frontend domain is in the CSRF array), then any subsequent request will pass those http-only cookies to the server when I mark the request with

  credentials: include
• 

  japineda162 years ago

  Changing to JWT, work as well

  
  
  

  Thank you so much!!!!

• 

  jarrod_not_jared

  2 years ago

  No problem 🙂