Can't set cookies on https

[unreal maple]

Hello, when running a react app talking to a Go backend (routing with Gin) I am able to set cookies locally but when I deploy both services to my production environment, which are secured with https, I can no longer set cookies. I can successfully reach the API with no issues, but cookies are not being set. Here is how I am setting them.

http.SetCookie(writer, &http.Cookie{
    Name:     cfg.CookieName,
    Value:    token,
    MaxAge:   maxAge,
    Path:     "/",
    Domain:   cfg.CookieDomain,
    SameSite: http.SameSiteNoneMode,
    Secure:   false,
    HttpOnly: false,
})

[timid briar]

Wait, to clarify is there one or two backends

and the cookies you can’t set, are they on a React front end or a Node.js backend

[trim badger]

is it http request? do you want to add cookie to a http request from go?

to add cookie to http request, use https://pkg.go.dev/net/http#Request.AddCookie

[unreal maple]

React frontend, communicating with a Go backend. The cookies get set perfectly on my development environment but then on production, which are both on https, it no longer works.

[lapis geyser]

Which http client are you using

[unreal maple]

Gin gonic

[lapis geyser]

Gin gonic is the web framework you are using, I mean the http client, are you using a web browser or something else

[unreal maple]

Chrome

[lapis geyser]

Alright, Make use of developer tools in the chrome browser to see if your cookie get set or not

What's the purpose of your cookie, are you using it for some kind of authorization

[unreal maple]

I think I've already answered this a few times. The cookies are set fine on my development environment (localhost) but once deployed to a production environment, the cookies are no longer set.

I think I am missing something in the response headers or how I have the "Set-Cookie" header configured on the backend, since my production environment is https

hence secured

[lapis geyser]

At the domain field hope you are not using localhost

[unreal maple]

Nope, its an environment variable which matches the domain.

I'm going to double check though lol

[lapis geyser]

Alright, you should do that

[unreal maple]

Just checked, its good

[lapis geyser]

What's the purpose of the cookie, could you send me your web app domain link

[lapis geyser]

Are you using it for session management or something else?

[unreal maple]

Its used for session management.

Here is a code snippet if where the "set-cookies" is set in the response header

switch config.Cfg.WorkingEnvironment {

case development:
    maxAge := GetCookieMaxAge(cfg.CookieMaxAgeDays)
    ctx.SetCookie(cfg.CookieName, token, maxAge, "", cfg.CookieDomain, false, false)

case production:
    maxAge := GetCookieMaxAge(cfg.CookieMaxAgeDays)
    ctx.SetSameSite(http.SameSiteStrictMode)
    ctx.SetCookie(cfg.CookieName, token, maxAge, "", cfg.CookieDomain, true, true)

default:
    break
}

ctx is a *gin.Context and SetCookie just basically wraps http.SetCookie

[lapis geyser]

Alright, could you send me the piece of code you are using to access the cookie on user request

[lapis geyser]

I get it

[unreal maple]

I mean its just this when accepting the cookies

token, err := ctx.Cookie(config.Cfg.CookieName)

but like I said before, this all works fine on my local environment lol

Its once they're both deployed to my production environment when it stops working

[lapis geyser]

Both on production and on development are accessing from same location, you need to check on the cfg.CookieDomain, I thing you are still using the localhost in the cooke domain field

[lapis geyser]

for production.

I don't know if you can share this part👇 config.cfg.WorkingEnvironment

[unreal maple]

Its just a constant that holds either "production" or "development"

and yes I said above that I checked the cookie domain, and it is fine.

[lapis geyser]

Alright

[lapis geyser]

Can I see the code

[unreal maple]

const (
    development = "development"
    production  = "production"
)

[trim badger]

i'm wondering, does it involve csrf ?

[lapis geyser]

on development you are using cfg. CookieDomain and on production you are using cfg.CookieDomain

Whatever you set on cfg.CookieDomain is been use in the development and production environment, I think you need to create a separate config struct for the production and pass in necessary value or you can create a pointer reciever method on that one struct, that will change the fields value in those struct to necessary value on condition production, the method need to get called first before doin the cookie setting

[lapis geyser]

if you are using the second part of my explanation then I guess you are not using pointer receiver or if it is function you are using then I guess you are passing by value not by reference

[unreal maple]

I think you are confusing yourself, those are environment variables. They get read in during compilation and the production value is most certainly not the same value as development.

[unreal maple]

It might be, I think its something to do with sending cookies on https.

[lapis geyser]

Alright, you can make use of the print debugging to see if environment variable on production is actually been read or not

[unreal maple]

They are required in order for the app to run, it panics if they are missing.

[lapis geyser]

Alright, that's good

[unreal maple]

Alright, so I was able to figure it out. I played with the same site and secure setting and these configurations worked.

http.SetCookie(ctx.Writer, &http.Cookie{
    Name:     cfg.CookieName,
    Value:    token,
    MaxAge:   maxAge,
    Path:     "/",
    Secure:   true,
    HttpOnly: true,
    SameSite: http.SameSiteNoneMode,
})

The domain was being read correctly from the environment variables, but seems to not like it when I add the domain. So I removed the domain and it worked.

The domain is in this format.

myaddress.netlify.app

Not sure if the format was not acceptable? Also, the cookies are there, but I cannot see them in the chrome tools, even if I set HttpOnly to false. I am still confused by that, but it's working like a charm now.

[lapis geyser]

Yeah, I think it because of the domain format, there are some rules on cookies, set by browsers base on the domain field

You can read this 👇

http://bayou.io/draft/cookie.domain.html