https://supertokens.com/ logo
Join Discord
Powered by
Hi, we're trying to make supertokens work on our v...
# support-questions-legacy
e
Hi, we're trying to make supertokens work on our vercel deployments url, the cookiedomain for the frontendConfig and backendConfig is set to 
.vercel.app
and 
cookieSameSite: none
what are we missing?
r
hey @edwinn1337
.vercel.app
is a special domain - it's in the public suffix list
so you can't set that to the cookieDomain
e
right! anyway we can make sessions work with vercel? it's for our staging deployments for our capacitor apps
r
e
thanks! 👍
ah i could also assign custom domain to specific branches on vercel
way easier 🙂
r
cool
e
Somehow I cant get it working... When logging it, we do another call to our backend verifying the session
Copy code
js
supertokens.init(backendConfig())

export default async function handler(req: SessionRequest, res: NextApiResponse & Response) {
  // we first verify the session
  await superTokensNextWrapper(async next => verifySession()(req, res, next), req, res)
session is invalid, thats due to cookies not accepted Our backendConfig we got
Copy code
js
    Session.init({
      cookieDomain: process.env.NODE_ENV === 'production' ? '.domain.nl' : 'localhost',
      cookieSameSite: process.env.NEXT_PUBLIC_APP_STAGE && process.env.NODE_ENV === 'development' ? 'strict' : 'none',
frontendConfig
Copy code
js
    Session.init({
      cookieDomain: process.env.NODE_ENV === 'production' ? '.domain.nl' : 'localhost',
r
can you be a bit more specific about whats not working?
e
Session not valid due cookies not saved,
we are using a subdomain 😉
r
why is the cookie not saved?
e
no clue, cant figure it out 😉 the superTokensNextWrapper is removing the cookies before I can take a look in the request hehe will remove this call to check moment
r
id need more info to help - the backend and frontend debug logs
e
lol turns out vercel didnt build a recent version
sorry! it works
r
haha ok!
m
@rp_st even we’ve tried setting cookieDomain on backend as x.example.com but it doesn’t set the refresh tokens etc.
We tried to configure the same on Frontend, it still doesn’t work
Although if I set .example.com. Everything works
So what we did was do exclude setting cookieDomain both in front end and backend
We skipped sessionScope config a well
Now everything works on same domain.
BUT another strange behaviour, the refresh token etc can’t be seen as set in chrome inspector. But once I get the refresh api to call, all 4 types of cookies I can see.
This means that refresh token etc is there somewhere. But not visible in chrome inspector
But strangely they become visible after refresh api is called. Which shouldn’t have worked if there were no refresh tokens
r
> This means that refresh token etc is there somewhere. But not visible in chrome inspector You need to navigate to the refresh api path on the browser to see it.
m
I thought so as well. But then I wonder why I am able to see it other times
will keep on experimenting to understand the browser behaviour better
r
yea.. chrome is strange sometimes. It shows the tokens when newly added.
m
@rp_st one more question I’ve. My client is hosted on x.test.com and backend is at auth.example.com
I’m able to set front tokens etc and use them. But the refresh tokens api doesn’t work so basically the user gets logged out in 1 hour without refresh of sessions
Is this how it behaves or am I missing something?
r
you need to set the samesite property of the cookie to 
none
m
I guessed so. But that does raise few Infosec flags in our team. Got it.
One last thing @rp_st how do we force secure flag for front tokens etc?
The http only and secure flag are set for refresh tokens etc
But not for front tokens
I do understand front end needs to read these. So we can leave httponly alone. But what about the secure flag? And what if we need to force both flags on all cookies?
r
Front token doesn’t contain anything sensitive
And the token by itself doesn’t give any access either
4 Views
PreviousNext
Powered by