Next.js Discord

Discord Forum

http only cookie doesn't work with next.js

Unanswered
Orinoco Crocodile posted this in #help-forum
Open in Discord
Orinoco CrocodileOP
There is an API, which sets an httpOnly cookie on a specific domain (domain B) when accessed. My website's domain is A, and I am using a proxy in Next. When making requests to the server on domain B through the proxy (rewrites in next.js), the httpOnly cookie should be sent, but it does not happen because the request is coming from domain A.

mext.config.js
    async rewrites() {
    return [

{
        source: '/api/authorization/sign-in', // request from domain A
        destination: `${process.env.WEB_API_BASEURL}/authorization/sign-in`, // set http only cookie on domain B
      },
      {
        source: '/api/authorization/refresh', // request from domain A
        destination: `${process.env.WEB_API_BASEURL}/authorization/refresh`, // doesn't sent http only cookie from domain B
      },
            {
        source: '/api/authorization/userinfo',
        destination: `${process.env.WEB_API_BASEURL}/authorization/userinfo`,
      },
    ]
  },



Without proxy everything works fine, but I neex use proxy

13 Replies

cookies are domain specific.
@DirtyCajunRice | AppDir cookies are domain specific.
Orinoco CrocodileOP
yes
rewriting the proxy doesnt magically make it a single request
it wont transfer
@DirtyCajunRice | AppDir rewriting the proxy doesnt magically make it a single request
Orinoco CrocodileOP
How can I deal with it?
@Orinoco Crocodile How can I deal with it?
use proper authentication?
if masquerading a cookie was as simple as a domain rewrite it wouldn’t be safe to use at all.
Orinoco CrocodileOP
I use proper authentication, I just want to hide api and to make proxy
period
@DirtyCajunRice | AppDir you cant proxy cookie authentication.
Orinoco CrocodileOP
unfortunately this is not the answer to the question. But thanks