HttpOnly Cookie authentication in Next.js
Unanswered
Broad-snouted Caiman posted this in #help-forum
Broad-snouted CaimanOP
I want to authenticate my Next.js app against an api that uses a HttpOnly cookie token as authentication. You call a login endpoint with credentials that in turn returns a response with a Set-Cookie header containing the token.
Since this is a HttpOnly cookie, client side javascript is not able to access this token. It's instead included in subsequent requests by the browser.
The issue with this is that since the call to the login endpoint is made in a client component it's only handled on the client. Which means requests made while SSR does not include this token.
How do you handle this in Next.js?
Since this is a HttpOnly cookie, client side javascript is not able to access this token. It's instead included in subsequent requests by the browser.
The issue with this is that since the call to the login endpoint is made in a client component it's only handled on the client. Which means requests made while SSR does not include this token.
How do you handle this in Next.js?
2 Replies
is this Auth API setting the Domain property of the cookie to always be sent to the Auth API itself, and not the Next.js server as well? I think the best solution would be to check in their docs if you can change the Domain of the cookie, otherwise instead of calling the Auth API directly, you could proxy it through your Next.js API and correctly fix the cookie so it gets sent to subsequent requests
Broad-snouted CaimanOP
@Rafael Almeida thank you for your response. It defaults to the host Domain. But I'm able to change it. However, I'm not really sure how this will help. Would you care to elaborate a bit?
If I'm not mistaken, you're not able to set the domain attribute to multiple domains. So I have to choose either the next server, or the api domain.
If I'm not mistaken, you're not able to set the domain attribute to multiple domains. So I have to choose either the next server, or the api domain.