Back

Sending cookies with fetch when cross orgin

  • 1
  • General
  • Web
Hexi
14 Jul, 2023, 18:17

Hi I do know this isn't fully appwrite related but the api endpoint does use appwrite 3. So the problem is that when I try to access localhost:3001 (and the front end on localhost:3000) and in the fetch include credentials everything works fine. But the problem is when I use a different origin so for example 127.0.0.1:3001 and still front end on localhost:3000 because it wont send the cookies and been working to fix this issue all day and now I am lost...

TypeScript
let test = await fetch("http://localhost:3001/api/checkout/createInvoice?amount=5100", {
  method: "POST",
  "headers": {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "currency": "USD",
    "description": "test",
  }),
  "credentials": "include"
});
test = await test.json();
console.log(test);
``` (Fetch example)



The first img one is the one that failed and the second is the one that works
TL;DR
Issue: Sending cookies with fetch when cross-origin is not working when using a different origin. Solution: 1. Set the "Set-Cookie" header on the sessions request to include `SameSite=None; Secure;`. 2. Use Ngrok or a similar tool to proxy `http` requests over `https`. Ensure that the protocol is `https` for the requests to work when the domain is different. 3. Include the "credentials" option set to "include" in the fetch request. Example: ```js let test = await fetch("http://localhost:3001/api/checkout/createInvoice?amount=5100
jordorama
14 Jul, 2023, 19:41

Ahh cookies are tricky. I'd recommend using something like Ngrok to proxy http requests over https. If the protocal isn't https they wont send if the domain is different (including port). I used ngrok + some secure flags on my cookies to get by.

jordorama
14 Jul, 2023, 19:43

a_session_${locals.config.appwriteProjectId}_legacy=${sessionToken}; path=/; SameSite=None; Secure;

a_session_${locals.config.appwriteProjectId}=${sessionToken}; path=/; SameSite=None; Secure;

Make sure your "Set-Cookie" header on your sessions request uses SameSite=None; Secure; like ^

Drake
14 Jul, 2023, 19:55

The problem is mostly due to 3rd party cookies being blocked

Hexi
15 Jul, 2023, 10:39

Alright will try that!

Reply

Reply to this thread by joining our Discord

Reply on Discord

Need support?

Join our Discord

Get community support by joining our Discord server.

Join Discord

Get premium support

Join Appwrite Pro and get email support from our team.

Learn more