Cookies not issued with different domain name
Unanswered
Northeast Congo Lion posted this in #help-forum
Northeast Congo LionOP
Hey guys, I've been working on a project with SST. I've been issuing cookies to the client with this method:
when I'm on localhost, no problems. When I deploy to cloudfront with SST, no problems. But now, when I switched to using a cname for my proper domain name, the cookies set with this method don't show up in my browser, and the requests subsequently fail (500 screen).
unfortunately this is over AWS so I only have a generic error to work with (shows 500 and then one of the internal functions fails). But if I were to guess, it's because there's something wrong with the cookies, and the cookies aren't showing up in the browser.
Any other ideas why it might be 500ing would be nice to know.
res.setHeader("Set-Cookie", serialize("authToken", token, {
httpOnly: true,
maxAge: 60 * 60 * Math.round(ageHours),
path: "/",
sameSite: "strict",
}))when I'm on localhost, no problems. When I deploy to cloudfront with SST, no problems. But now, when I switched to using a cname for my proper domain name, the cookies set with this method don't show up in my browser, and the requests subsequently fail (500 screen).
unfortunately this is over AWS so I only have a generic error to work with (shows 500 and then one of the internal functions fails). But if I were to guess, it's because there's something wrong with the cookies, and the cookies aren't showing up in the browser.
Any other ideas why it might be 500ing would be nice to know.
23 Replies
European sprat
you should add some console logs to see what the request url is along with other things. maybe it's getting some internal URL that is different than the actual URL you want to set cookies for
Northeast Congo LionOP
Fair enough. Let me do that RQ. Any suggestions on what console logs and where? I totally get it if you have no idea
also, it says "httpOnly" in the settings - would that mess with me if it's https? (That sounds like a very dumb question and I'm sorry if it is lol)
samesite = strict
would that do anything either?
European sprat
log out the request object before you try to set the cookie and see if there's anything strange in there regarding the host name that my point you in the right direction
Northeast Congo LionOP
will do. I just got an interesting console log though. "User not found"
so the question is what user is it trying to find, and why isn't that user in the DB?
that would explain why the cookie isn't being issued
Testing with the production system.... very healthy practices lol
Northeast Congo LionOP
No, looks like the login is fine, the "User not found" error is coming from a diff part of the code, when it attempts to FIND the cookie
so the error is downstream of the login. Login was doing what it was supposed to anyway so all good there...
res.setHeader("Set-Cookie", serialize("authToken", token, {
httpOnly: true,
maxAge: 60 * 60 * Math.round(ageHours), // 2 hours in seconds
path: "/",
sameSite: "strict",
}))
console.log("Set cookie to ",res)Northeast Congo LionOP
I'm like 99% sure my browser just isn't accepting the cookie for some reason
chrome is a fickle beast 😬
noooooooooooooooooooooooooooooooooooooooo
I found the error
So turns out the biological username/password typing device was providing incorrect credentials
so uh
AKA I was typing the wrong password in, and the system approved it
100x worse than I thought
European sprat
Northeast Congo LionOP
Me:
type in wrong password
my app:
"Looks good."
does not issue cookie
also app:
redirects to user profile page
user profile page:
where cookie
type in wrong password
my app:
"Looks good."
does not issue cookie
also app:
redirects to user profile page
user profile page:
where cookie