http only cookie doesn't work with next.js
Unanswered
Orinoco Crocodile posted this in #help-forum
Orinoco CrocodileOP
There is an API, which sets an httpOnly cookie on a specific domain (domain B) when accessed. My website's domain is A, and I am using a proxy in Next. When making requests to the server on domain B through the proxy (rewrites in next.js), the httpOnly cookie should be sent, but it does not happen because the request is coming from domain A.
mext.config.js
Without proxy everything works fine, but I neex use proxy
mext.config.js
async rewrites() {
return [
{
source: '/api/authorization/sign-in', // request from domain A
destination: `${process.env.WEB_API_BASEURL}/authorization/sign-in`, // set http only cookie on domain B
},
{
source: '/api/authorization/refresh', // request from domain A
destination: `${process.env.WEB_API_BASEURL}/authorization/refresh`, // doesn't sent http only cookie from domain B
},
{
source: '/api/authorization/userinfo',
destination: `${process.env.WEB_API_BASEURL}/authorization/userinfo`,
},
]
},Without proxy everything works fine, but I neex use proxy
13 Replies
cookies are domain specific.
@DirtyCajunRice | AppDir cookies are domain specific.
Orinoco CrocodileOP
yes
rewriting the proxy doesnt magically make it a single request
it wont transfer
@DirtyCajunRice | AppDir rewriting the proxy doesnt magically make it a single request
Orinoco CrocodileOP
How can I deal with it?
@Orinoco Crocodile How can I deal with it?
use proper authentication?
if masquerading a cookie was as simple as a domain rewrite it wouldn’t be safe to use at all.
Orinoco CrocodileOP
I use proper authentication, I just want to hide api and to make proxy
@Orinoco Crocodile I use proper authentication, I just want to hide api and to make proxy
you cant proxy cookie authentication.
period
@DirtyCajunRice | AppDir you cant proxy cookie authentication.
Orinoco CrocodileOP
unfortunately this is not the answer to the question. But thanks