HttpOnly cookie setting in local deployment but not remote deployment

Question

I have a local server that successfully sets an HtmlOnly cookie on a local client, but the same code on a remote server is not setting the cookie.

The local server is a Chalice server running on http://localhost:8000. The response headers are:

{
    'Content-Type': 'application/json', 
    'Access-Control-Allow-Origin': 'http://localhost:5000', 
    'Access-Control-Allow-Credentials': 'true', 
    'Set-Cookie': 'refresh-token=my_token_value; <Max-Age>=605000; Path=/; HttpOnly'
}

The local client is running on http://localhost:5000'. It is calling via fetch:

fetch("http://localhost:8000/login", {
    method: 'POST',
    headers: {'Content-Type': 'text/plain'},
    body: JSON.stringify(payload),
    credentials: 'include',
    mode: 'cors'
})

The remote server is running on something like https://my-server-domain.com/api. The response headers are:

{
    'Content-Type': 'application/json', 
    'Access-Control-Allow-Origin': 'https://my-client-domain.com', 
    'Access-Control-Allow-Credentials': 'true', 
    'Set-Cookie': 'refresh-token=my_token_value; <Max-Age>=605000; Path=/; HttpOnly'
}

The remote client is running on something like https://my-client-domain.com. It is calling the same way as the local client:

fetch("https://my-server-domain.com/api/login", {
    method: 'POST',
    headers: {'Content-Type': 'text/plain'},
    body: JSON.stringify(payload),
    credentials: 'include',
    mode: 'cors'
})

The API calls to the remote server work -- they return the expected response -- but the cookie is not getting set to the browser. Any suggestions as to why this might be?

score 0 · Answer 1 · answered Aug 16 '21 at 19:42

0

Try to simple set the cookies directly on client, then send to server

answered Aug 16 '21 at 19:42

UserOfStackOverFlow

108
1
3
14

When I set a cookie manually with `document.cookie = 'simple_key=simple_value; path=/'` the cookie appears in my local server but not on my remote server. I've also tried adding combinations of `'; secure'`, `'; domain=my-server-domain.com'` and `'; domain=https://my-server-domain.com'`. No cookies appear on my remote server. – v4gil Aug 16 '21 at 20:36
Seems like that it's a server-side configuration, try to handle the basics for functionalities checking. – UserOfStackOverFlow Aug 17 '21 at 12:51

score 0 · Accepted Answer · answered Aug 18 '21 at 17:19

0

The big difference between my local deployment and remote deployment was running over https. What ended up working was setting SameSite=None; Secure to the cookie.

answered Aug 18 '21 at 17:19

v4gil

842
1
10
16

HttpOnly cookie setting in local deployment but not remote deployment

2 Answers2