0

I am trying to access an endpoint on my Express server that has an http only cookie as part of the authentication dance to gain access.

Here we set the http only cookie:

res.cookie('jwt', refreshToken, { httpOnly: true, sameSite: 'none', secure: true, maxAge: 3 * 24 * 60 * 60 * 1000 }); 
            return res.send({ accessToken, role: userModel.role, profileId: userModel.profile });

Here is my endpoint I am trying to integration test:

router.delete('/auth/delete/:id', basicAuth, checkAccountId, mentors.deleteMentorProfile);

Inside basicAuth there is this: export const basicAuth = passport.authenticate('jwt', { session: false, failWithError: true });

What I think is required is that the httponly cookie is sent with the request to this endpoint. The line says passport.authenticate('jwt', ...) hence I must need the 'jwt' value to be there in a cookie.

And here is the code from my integration test:

const logInResponse = await api.post('/api/users/authenticate').send(userAcctCreationDetails);
            const jwtForTest = logInResponse.body.accessToken;
            const allMentors = await Mentor.find({});
            const testAccountMentorId = allMentors.find((mentor) => mentor.email === userToDelete.email)?._id.toString();
            // act
            const cookies = logInResponse.headers['set-cookie'][0];
            // console.log(cookies);
            const deletedProfileResponse = await api
                .delete('/api/mentor/auth/delete/' + testAccountMentorId)
                .set('Authorization', 'Bearer ' + jwtForTest)
                .set('jwt', cookies); // this fails!

The line console.log(cookies) says some authentication credentials ending in jwt=eyJhbGciOi...-2n21vxTNPOlS94-YeFhSN7o; Max-Age=259200; Path=/; Expires=Thu, 15 Dec 2022 01:26:24 GMT; HttpOnly; Secure; SameSite=None

My coworker tells me "httponly means the client can't access it" but can I at least send it back? How does a browser send it back if not via javascript?

Note I did google it and i found extreme scarcity of information about supertest and HTTP only cookies.

plutownium
  • 1,220
  • 2
  • 9
  • 23
  • Does this answer your question? [I am trying to set a cookie in supertest but it does not work](https://stackoverflow.com/questions/71314834/i-am-trying-to-set-a-cookie-in-supertest-but-it-does-not-work) – jonrsharpe Dec 13 '22 at 10:13

0 Answers0