HttpOnly cookies are not being sent in server-side API calls in Next.js.
Answered
Orinoco Crocodile posted this in #help-forum
Orinoco CrocodileOP
Expected behavior:
I expect the HttpOnly cookies to be included in the request headers when making server-side API calls in Next.js.
Actual behavior:
The HttpOnly cookies are missing from the request headers in server-side API calls.
I expect the HttpOnly cookies to be included in the request headers when making server-side API calls in Next.js.
Actual behavior:
The HttpOnly cookies are missing from the request headers in server-side API calls.
Answered by Giant panda
Cookies aren't propagated for safety reasons. If you want to relay a cookie from a client to another server you have to manually attach it to the request by reading it via
cookies and adding it to headers in the outgoing request.12 Replies
@Orinoco Crocodile do u want to automatically transfer cookies from a web browser to the request header of fetching an upstream API like a reverse proxy?
Giant panda
Cookies aren't propagated for safety reasons. If you want to relay a cookie from a client to another server you have to manually attach it to the request by reading it via
cookies and adding it to headers in the outgoing request.Answer
as Near said above, you cannot do that automagically.
Broad-snouted Caiman
But you can't access HttpOnly cookies through javascript. So how do you add them to the headers in the outgoing SSR request?
@Broad-snouted Caiman But you can't access HttpOnly cookies through javascript. So how do you add them to the headers in the outgoing SSR request?
Japanese common catfish
HttpOnly cookies can be read in server actions (and propagated).
they are just not availbale to read by browser JS
Broad-snouted Caiman
@Japanese common catfish Alright, thanks. I guess a proxy of some sort is what you need then if you don't want to use unstable features, such as server actions.
@Broad-snouted Caiman <@358313783862624259> Alright, thanks. I guess a proxy of some sort is what you need then if you don't want to use unstable features, such as server actions.
Japanese common catfish
this is not an unstable feature. That is just how cookies work.
Broad-snouted Caiman
@Japanese common catfish I'm talking about nextjs server actions.
Japanese common catfish
Either way, cookies can not be propagated automatically.
Broad-snouted Caiman
Alright, thanks. I'll look into creating a proxy. I really wanted to avoid it though, but it's better than going fully CSR.