https://supertokens.com/ logo
Join Discord
Powered by
I having some trouble with cookies and/or CORS and...
# support-questions-legacy
y
I having some trouble with cookies and/or CORS and hope you guys can help. I have a web domain (test.com) and api domain (api.test.com). I have setup CORS on NestJS has per the docs, and things seem to work correctly (I can send requests from the web client to the api). However there are 2 problems. a) there's an OPTIONS preflight before every request (do I need to set 
Access-Control-Max-Age
manually?) and b) my cookies are not being saved in my browser, probably because they are sub domain but I was under the assumption that sub domain cookies are still regarded as samesite?
r
hey!
You can't prevent the OPTIONS requests.
y
Hi. I think the problem is that I haven't set 
cookieDomain
on my Session init object
r
About the browser not saving the cookies, can i see the response headers for the sign in API call? A screenshot from the chrome's network tab would work
You don't need to set the cookieDomain unless you want to share the cookies across multiple API domains - which by the description, it seems you do not.
y
I am receiving cookies back from the api (there are Set-Cookie headers in the response). They aren't getting set in the browser however
r
is there an orange triangle next to the set-cookie response header?
y
No?
r
at the end of the header
y
No it looks normal
r
can i see the full screenshot of the response header
can i see the full screenshot of the response header
right ok
so the browser is saving the cookie
what are the request headers for an APi call that you make in whcih you expect the access token to be attached?
y
In the request there are no cookie headers set
r
can i see all the request headers?
ok. So the interception from our frontend SDK is not being applied
are you using axios?
right ok. So the interception is being applied
are you setting the credentials setting to false when making an APi call?
y
They are being set to same-origin
r
don't set them
remove that credentials setting
or set it to credentials: "include"
y
Wouldn't that mean that cookies are sent cross-origin? or does sameSite prevent that?
r
same site prevents that
it will only send the cookie to other sub domains
not a different domain
y
I see, thanks
9 Views
PreviousNext
Powered by