vendredi 22 octobre 2021

HttpOnly cookie generated on the server is present in Set-Cookie header but is not being saved while running locally

I have an Angular application with Spring boot in the backend.

On the server side I generate an HttpOnly cookie, which is then to be saved.

@CrossOrigin(origins = "*", allowedHeaders = "*", allowCredentials = "true")
@GetMapping("token")
public AuthenticationResponseDto generateToken(
                                               HttpServletResponse response) {
    log.info("Creating token");
    String username = "user";
    String password = "pass";
    authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, 
    password));
    String token = tokenProvider.createToken(username);
    ResponseCookie resCookie = ResponseCookie.from(cookieName, token)
            .sameSite("none")
            .secure(true)
            .httpOnly(true)
            .path("/")
            .maxAge(expiration)
            .build();
    response.addHeader(HttpHeaders.SET_COOKIE, resCookie.toString());
    response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "Set-Cookie");
    response.addHeader(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, "Set-Cookie");
    response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET");
    return AuthenticationResponseDto.builder()
            .issuedAt(LocalDateTime.now())
            .expiration(new Timestamp(System.currentTimeMillis() + 
    1000L*3600).toLocalDateTime())
            .accessToken(token)
            .build();
}

This is request/response

General:

Request URL: https://127.0.0.1:8082/auth/token
Request Method: GET
Status Code: 200 
Remote Address: 127.0.0.1:8082
Referrer Policy: strict-origin-when-cross-origin

Response:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Set-Cookie
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://localhost:4200
Access-Control-Expose-Headers: Set-Cookie
Connection: keep-alive
Content-Type: application/json
Date: Fri, 22 Oct 2021 15:57:56 GMT
Keep-Alive: timeout=60
Set-Cookie: authentication_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvcGVud2ViLXVzZXIiLCJpYXQiOjE2MzQ5MTgyNzUsImV4cCI6MTYzNTI3ODI3NX0.AJUpJ_MR9ttLNnlUOhjVIfGqs5SEpkGHT_Gp4TwS8Gw; Path=/; Max-Age=360000; Expires=Tue, 26 Oct 2021 19:57:55 GMT; Secure; HttpOnly; SameSite=none
Transfer-Encoding: chunked
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers

Request:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cookie: authentication_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvcGVud2ViLXVzZXIiLCJpYXQiOjE2MzQ5MTcyMDEsImV4cCI6MTYzNTI3NzIwMX0.u05C4RKlHDS0JGqqYUI4tEtu1BxpqeUJRkL8l2QMyfg
Host: 127.0.0.1:8082
Origin: https://localhost:4200
Referer: https://localhost:4200/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

And this is the request(Angular 11):

if(error.status === 403) {
            console.log("Refreshing access token");
            return this.http.get("https://127.0.0.1:8082/auth/token",
               {withCredentials: true}).pipe(map(response => {
              return response.toString();
            }));
          }

As you can see Set-Cookie header is present in the response, but is not saved whatsoever. I've tried pretty much everything, including enabling Https, to make Samesite=None;Secure work. Also here is a piece of info from Chrome events tool

28772: URL_REQUEST
https://127.0.0.1:8082/auth/token
Start Time: 2021-10-22 17:35:11.434

t=631995 [st= 0] +REQUEST_ALIVE  [dt=14]
                  --> priority = "MEDIUM"
                  --> traffic_annotation = 101845102
                  --> url = "https://127.0.0.1:8082/auth/token"
t=631996 [st= 1]    NETWORK_DELEGATE_BEFORE_URL_REQUEST  [dt=0]
t=631996 [st= 1]   +URL_REQUEST_START_JOB  [dt=13]
                    --> initiator = "https://localhost:4200"
                    --> load_flags = 64 (DO_NOT_SAVE_COOKIES)
                    --> method = "OPTIONS"
                    --> network_isolation_key = "https://localhost https://localhost"
                    --> privacy_mode = "enabled"
                    --> request_type = "other"
                    --> site_for_cookies = "SiteForCookies: {site=null; schemefully_same=false}"
                    --> url = "https://127.0.0.1:8082/auth/token"

The request has load_flag DO_NOT_SAVE_COOKIES, which is probably the root of the problem. As I suppose, the process of setting such cookies should not be a too complex process. Does anyone have any ideas on that?

Aucun commentaire:

Enregistrer un commentaire