missing cookies

Question

this is really baffling to me but maybe someone has an idea I m trying to move to ESM and all of a sudden `createNewSession` from the Recipe Session of the `supertokens node` SDK cannot set the cookies not really sure what s going on I can see the sessions getting created in the table but the cookies doesn t get set

rp · Answer

hey < ZeferiniX> which version of the SDK are you using

ZeferiniX · Answer

supertokens node 13 4 1

ZeferiniX · Answer

with docker image supertokens supertokens postgresql 4 6

rp · Answer

right When making the request to sign in are you setting the `st auth mode cookie ` header in the request

rp · Answer

our frontend SDK set s this by default but in case you are not using our frontend SDK or querying the API manually then you need to set this header

ZeferiniX · Answer

is it needed https supertokens com docs session common customizations sessions new session

rp · Answer

by default the createNewSession function uses non cookie based session

rp · Answer

so you need to set this header in the request and then it will set it in cookies instead

ZeferiniX · Answer

let me try

ZeferiniX · Answer

oh that worked but it only sets the access token I recall seeing a refresh token <a weedythink 938877112130076732> is this expected

rp · Answer

refresh token should also be set See the response headers

ZeferiniX · Answer

oh so this wasn t related to ESM at all my bad < shyhiyori 952277158754144266>

rp · Answer

yea

ZeferiniX · Answer

I suppose the Frontend SDKs automatically grabs that but previously the Backend SDKs sets these server side

rp · Answer

that happens now as well

ZeferiniX · Answer

well that s weird I only see the access token in the cookie page of devtools <a weedythink 938877112130076732>

rp · Answer

in the response headers

rp · Answer

to see the refresh token you have to navigate to the refresh token path on your api domain

rp · Answer

chrome deosn t show it otherwise

ZeferiniX · Answer

it s in the response headers as well

ZeferiniX · Answer

oh

rp · Answer

yup

ZeferiniX · Answer

is this documented somewhere

ZeferiniX · Answer

https supertokens com docs session migration session migration

ZeferiniX · Answer

other than this I couldn t figure this out xD

rp · Answer

> is this documented somewhere The migration That s in the changelog of the SDKs on our github

ZeferiniX · Answer

no the `st auth mode` requirement and navigating to the refresh token path back in v12 the `sAccessToken` and `sRefreshToken` just gets set also checked the changelog and the initial impression I got was just simply passing the `req` object as well in the `createNewSession` https github com supertokens supertokens node blob master CHANGELOG md 1300 2023 02 01

rp · Answer

so in v12 the refresh token behaviour was the same you had to navigate to the refresh path as well

ZeferiniX · Answer

we have a workaround in our local dev env backend where we expose a GET endpoint that automatically logs in a superadmin when it gets hit the access and refresh tokens just gets set and seen in chrome dev tools but in v13 that s not the case anymore

ZeferiniX · Answer

thus the question < shyhiyori 952277158754144266>

rp · Answer

im quite sure that the refresh token behaviour is the same as before

rp · Answer

the only diff is that now you need to set st auth mode header in the request which our frontend sdk does on its own

ZeferiniX · Answer

https cdn discordapp com attachments 1096804291022438411 1096815916609708143 chrome 2023 04 15 231435387 gif

ZeferiniX · Answer

from this GIF I hit the GET endpoint and only the `sAccessToken` gets set with the `st auth mode` header set to cookie

ZeferiniX · Answer

in v12 both access and refresh tokens gets set

rp · Answer

you need to navigate to the apidomain auth session refresh on the browser and you will see the refreesh token

rp · Answer

this is a chrome thing

rp · Answer

not a supertokens thing

rp · Answer

cause refresh token is being set Chrome isn t showing it unless you navigate to the refresh path

rp · Answer

you can try firefox instead and you will see

rp · Answer

cause firefox shows all cookies for a domain regardless of the path

ZeferiniX · Answer

ohh

ZeferiniX · Answer

https cdn discordapp com attachments 1096804291022438411 1096817072933175296 image png

ZeferiniX · Answer

that cookie has a path value now in v13 is what you meant

rp · Answer

it used to have a path before as well

ZeferiniX · Answer

wait really

rp · Answer

again this is a chrome thing

rp · Answer

yup

ZeferiniX · Answer

damn

rp · Answer

anyhow hope this helped

ZeferiniX · Answer

yeah I see it on firefox welp I ll look into this chrome quirk

ZeferiniX · Answer

thank you very much