I have an Angular application with Spring boot in the backend.
On the server side I generate an HttpOnly cookie, which is then to be saved.
@CrossOrigin(origins = "*", allowedHeaders = "*", allowCredentials = "true")
@GetMapping("token")
public AuthenticationResponseDto generateToken(
HttpServletResponse response) {
log.info("Creating token");
String username = "user";
String password = "pass";
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username,
password));
String token = tokenProvider.createToken(username);
ResponseCookie resCookie = ResponseCookie.from(cookieName, token)
.sameSite("none")
.secure(true)
.httpOnly(true)
.path("/")
.maxAge(expiration)
.build();
response.addHeader(HttpHeaders.SET_COOKIE, resCookie.toString());
response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "Set-Cookie");
response.addHeader(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, "Set-Cookie");
response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET");
return AuthenticationResponseDto.builder()
.issuedAt(LocalDateTime.now())
.expiration(new Timestamp(System.currentTimeMillis() +
1000L*3600).toLocalDateTime())
.accessToken(token)
.build();
}
This is request/response
General:
Request URL: https://127.0.0.1:8082/auth/token
Request Method: GET
Status Code: 200
Remote Address: 127.0.0.1:8082
Referrer Policy: strict-origin-when-cross-origin
Response:
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Set-Cookie
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://localhost:4200
Access-Control-Expose-Headers: Set-Cookie
Connection: keep-alive
Content-Type: application/json
Date: Fri, 22 Oct 2021 15:57:56 GMT
Keep-Alive: timeout=60
Set-Cookie: authentication_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvcGVud2ViLXVzZXIiLCJpYXQiOjE2MzQ5MTgyNzUsImV4cCI6MTYzNTI3ODI3NX0.AJUpJ_MR9ttLNnlUOhjVIfGqs5SEpkGHT_Gp4TwS8Gw; Path=/; Max-Age=360000; Expires=Tue, 26 Oct 2021 19:57:55 GMT; Secure; HttpOnly; SameSite=none
Transfer-Encoding: chunked
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Request:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cookie: authentication_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvcGVud2ViLXVzZXIiLCJpYXQiOjE2MzQ5MTcyMDEsImV4cCI6MTYzNTI3NzIwMX0.u05C4RKlHDS0JGqqYUI4tEtu1BxpqeUJRkL8l2QMyfg
Host: 127.0.0.1:8082
Origin: https://localhost:4200
Referer: https://localhost:4200/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
And this is the request(Angular 11):
if(error.status === 403) {
console.log("Refreshing access token");
return this.http.get("https://127.0.0.1:8082/auth/token",
{withCredentials: true}).pipe(map(response => {
return response.toString();
}));
}
As you can see Set-Cookie header is present in the response, but is not saved whatsoever. I've tried pretty much everything, including enabling Https, to make Samesite=None;Secure work. Also here is a piece of info from Chrome events tool
28772: URL_REQUEST
https://127.0.0.1:8082/auth/token
Start Time: 2021-10-22 17:35:11.434
t=631995 [st= 0] +REQUEST_ALIVE [dt=14]
--> priority = "MEDIUM"
--> traffic_annotation = 101845102
--> url = "https://127.0.0.1:8082/auth/token"
t=631996 [st= 1] NETWORK_DELEGATE_BEFORE_URL_REQUEST [dt=0]
t=631996 [st= 1] +URL_REQUEST_START_JOB [dt=13]
--> initiator = "https://localhost:4200"
--> load_flags = 64 (DO_NOT_SAVE_COOKIES)
--> method = "OPTIONS"
--> network_isolation_key = "https://localhost https://localhost"
--> privacy_mode = "enabled"
--> request_type = "other"
--> site_for_cookies = "SiteForCookies: {site=null; schemefully_same=false}"
--> url = "https://127.0.0.1:8082/auth/token"
The request has load_flag DO_NOT_SAVE_COOKIES, which is probably the root of the problem. As I suppose, the process of setting such cookies should not be a too complex process. Does anyone have any ideas on that?
Aucun commentaire:
Enregistrer un commentaire