Live Preview and CSRF

asura_ks9 months ago

3

• 

  arimepareto_6654010 months ago

  I have a similar issue with the exception that I'm working on Google infrastructure: the application that implements live preview runs on Firebase and Payload on Cloud Run (different domains). I've tried to follow the instructions on setting up CORS and CSRF closely and everything run smoothly locally, but when I deploy the apps and try to use live preview for my collection, I'm getting response 403 from Payload when fetching relationships. I'm suspecting this is some sort of cookie sharing issue between sites (see attached screenshot), but I don't know how to solve it.

  
  
  

  Can live preview even work if Payload and the preview app run in two completely different domains?

  
  
  

  I found out that I can edit cookie options in my Users collection like so:

  
  
  

  const Users: CollectionConfig = {
    slug: "users",
    auth: {
      useAPIKey: true,
      cookies: {
        secure: true,
        sameSite: "none",
      },
    },
    ...

  
  
  

  This seemed to fix the issue for me, hope this helps someone else too!
• 

  notchr10 months ago

  TY for posting your solution

  
  
  

  Let us know if you run into any more issues