-1

After login api I set res.cookie from server with flag HttpOnly true, secure true, samesite: true. Cookie is a jwt token so I need read the cookie to get user data, then ditpatch to Redux for login and change UI.

Cookies in application

I can read any cookie in NextJs, but ReactJs is not. Any solution for my case. If i can not set HttpOnly true, Does it mean other site can easy get my cookie? Does the HttpOnly flag really matter?

Any solution. Maybe change my login flow. Thanks

Joyce
  • 1
  • 1

1 Answers1

-2

Without additional context and the code snippet, it's difficult to pinpoint what you're trying to do.

However, In a client-side app built with React.js you can't directly access cookies marked with HttpOnly flag for security reasons. The HttpOnly flag is designed to prevent client-side JS from accessing cookies, enhancing the security of sensitive info stored in cookies, such as session tokens or auth tokens.

You can send the cookies automatically with each request to the server and make the server validate the cookie and retrieve the necessary info..

Some possible approaches include Using a API endpoint, Proxy the request or store necessary info in the client-side.

Even if other sites cannot directly read your cookies, it is still important to implement additional security measures and best practices to protect sensitive user information and prevent unauthorized access to your application.

You should consider reviewing your login flow. Check this

Anandhu Remanan
  • 55
  • 7
  • The same answer with my search result. But no problem. I will find a better solution. Thank you – Joyce May 22 '23 at 21:06
  • This answer looks like it was generated by an AI (like ChatGPT), not by an actual human being. You should be aware that [posting AI-generated output is officially **BANNED** on Stack Overflow](https://meta.stackoverflow.com/q/421831). If this answer was indeed generated by an AI, then I strongly suggest you delete it before you get yourself into even bigger trouble: **WE TAKE PLAGIARISM SERIOUSLY HERE.** Please read: [Why posting GPT and ChatGPT generated answers is not currently allowed](https://stackoverflow.com/help/gpt-policy). – tchrist Jul 17 '23 at 01:27