I tried setting some data using merge access token...
# support-questions-legacyc
chunkygoo.
09/23/2022, 3:22 AMI tried setting some data using merge access token payload on the backend and then useSessionContxt to get the payload on the frontend. I am able to set the data properly on the backend but when I try to get it on the frontend it is always an empty object {}. Any idea why?
r
rp_st
09/23/2022, 4:00 AMHey!
rp_st
09/23/2022, 4:00 AMHey!
rp_st
09/23/2022, 4:01 AMCan you print out the value of sFrontToken here that you see in the cookie on your browser? (After the backend has updated the access token payload)
rp_st
09/23/2022, 4:01 AMAlso, are you using axios or fetch when you make that api call?
c
chunkygoo.
09/23/2022, 4:45 AMaxios and I have used done this: Session.addAxiosInterceptors(myAxios);
r
rp_st
09/23/2022, 4:45 AMHmmm
rp_st
09/23/2022, 4:46 AMCan you enable frontend debug logs and show me the output of that when you make that api call?
c
chunkygoo.
09/23/2022, 4:46 AMHow do I enable frontend debug?
r
rp_st
09/23/2022, 4:48 AMCheckout troubleshooting section in docs
c
chunkygoo.
09/23/2022, 5:23 AMWill try that out... On a different not, I have cookie_secure=True? My understanding is that with cookie_secure=True, cookies will only be transmitted on https. I am developing on http://localhost. How come the cookies are getting transmitted anyway?
r
rp_st
09/23/2022, 5:23 AMis your API domain on https?
c
chunkygoo.
09/23/2022, 5:24 AMNo both are on localhost
r
rp_st
09/23/2022, 5:24 AMhmmm and both with http?
c
chunkygoo.
09/23/2022, 5:24 AMfastapi localhost, nextjs localhost. Both http
r
rp_st
09/23/2022, 5:25 AMthats weird
rp_st
09/23/2022, 5:25 AMwhen you login, and you get the set-cookie header back, what is that value of that header?
c
chunkygoo.
09/23/2022, 5:27 AMCan't seem to get that the page refreshes
r
rp_st
09/23/2022, 5:27 AMok open the cookie store on the browser
rp_st
09/23/2022, 5:27 AMand see the sAccessToken value
rp_st
09/23/2022, 5:27 AMdo you see a tick against the secure attribute?
c
chunkygoo.
09/23/2022, 5:27 AMNope
r
rp_st
09/23/2022, 5:27 AMhmm.
c
chunkygoo.
09/23/2022, 5:28 AMWait
chunkygoo.
09/23/2022, 5:28 AMI do
chunkygoo.
09/23/2022, 5:28 AMYes there is a tick on secure
r
rp_st
09/23/2022, 5:28 AMright
c
chunkygoo.
09/23/2022, 5:28 AMand also http
chunkygoo.
09/23/2022, 5:28 AMhttponly
r
rp_st
09/23/2022, 5:28 AMso the browser is sending these cookies even if you are just using
http://...c
chunkygoo.
09/23/2022, 5:29 AMYes
chunkygoo.
09/23/2022, 5:29 AMr
rp_st
09/23/2022, 5:29 AMthat's really odd
rp_st
09/23/2022, 5:29 AMwhich browser?
c
chunkygoo.
09/23/2022, 5:29 AMThis is chrome
chunkygoo.
09/23/2022, 5:29 AMWeird thing is I was using jwt_auth, a library for fast api
chunkygoo.
09/23/2022, 5:29 AMAnd it was the same
chunkygoo.
09/23/2022, 5:30 AMI set the secure flag to true, and the cookies transmit anyway
chunkygoo.
09/23/2022, 5:30 AMIn fact, if you do not have secure=true,
chunkygoo.
09/23/2022, 5:30 AMChrome will put a yellow triangle warning you
r
rp_st
09/23/2022, 5:30 AMhuh
c
chunkygoo.
09/23/2022, 5:30 AMSo you have to use secure cookies else it wont work on chrome
r
rp_st
09/23/2022, 5:30 AMthis is very very strange
c
chunkygoo.
09/23/2022, 5:30 AMI think they made this adjustment a few years ago
r
rp_st
09/23/2022, 5:30 AMnever heard of this issue before
rp_st
09/23/2022, 5:31 AMcan I see the full request sent by chrome to one of the APIs which requires a session?
rp_st
09/23/2022, 5:31 AMThe URL, request headers, response headers
c
chunkygoo.
09/23/2022, 5:32 AMchunkygoo.
09/23/2022, 5:32 AMIt says "The new rule demands that all cross-site cookies set in a browser have to be set with Secure attribute if they are to have None as their SameSite value. This is esoterically for cookies meant to be served in cross-site contexts only."
chunkygoo.
09/23/2022, 5:32 AMI will show you those tmr it's late here
r
rp_st
09/23/2022, 5:32 AMyea.. but then you also need to send a query to https and not http
rp_st
09/23/2022, 5:32 AMthe fact that its sending the secure cookies with http, is just weird.
c
chunkygoo.
09/23/2022, 5:32 AMYes
chunkygoo.
09/23/2022, 5:33 AMI would like to know why
chunkygoo.
09/23/2022, 5:33 AMAre you one of the ST devs?
chunkygoo.
09/23/2022, 5:33 AMMaybe they can help...
r
rp_st
09/23/2022, 5:33 AMyup i am
rp_st
09/23/2022, 5:33 AMcan you open an issue about this on one of our repos? We can check it out
c
chunkygoo.
09/23/2022, 5:49 PMI think this was intended
chunkygoo.
09/23/2022, 5:49 PMchunkygoo.
09/23/2022, 5:49 PMsecure works as expected except for "localhost"
r
rp_st
09/23/2022, 5:50 PMAhh I see
17 Views