Hi, we're trying to make supertokens work on our vercel deployments url, the cookiedomain for the frontendConfig and backendConfig is set to

.vercel.app

and

cookieSameSite: none

what are we missing?

hey @EdwinN1337

right! anyway we can make sessions work with vercel? it's for our staging deployments for our capacitor apps

im not sure if this will help, but see here: https://supertokens.com/blog/how-to-deploy-supertokens-with-react-nodejs-express-on-vercel

thanks! 👍

cool

Somehow I cant get it working... When logging it, we do another call to our backend verifying the session

js
supertokens.init(backendConfig())

export default async function handler(req: SessionRequest, res: NextApiResponse & Response) {
  // we first verify the session
  await superTokensNextWrapper(async next => verifySession()(req, res, next), req, res)

session is invalid, thats due to cookies not accepted Our backendConfig we got

js
    Session.init({
      cookieDomain: process.env.NODE_ENV === 'production' ? '.domain.nl' : 'localhost',
      cookieSameSite: process.env.NEXT_PUBLIC_APP_STAGE && process.env.NODE_ENV === 'development' ? 'strict' : 'none',

frontendConfig

js
    Session.init({
      cookieDomain: process.env.NODE_ENV === 'production' ? '.domain.nl' : 'localhost',

can you be a bit more specific about whats not working?

Session not valid due cookies not saved,

why is the cookie not saved?

no clue, cant figure it out 😉 the superTokensNextWrapper is removing the cookies before I can take a look in the request hehe will remove this call to check moment

id need more info to help - the backend and frontend debug logs

lol turns out vercel didnt build a recent version

haha ok!

@rp even we’ve tried setting cookieDomain on backend as x.example.com but it doesn’t set the refresh tokens etc.

> This means that refresh token etc is there somewhere. But not visible in chrome inspector You need to navigate to the refresh api path on the browser to see it.

I thought so as well. But then I wonder why I am able to see it other times

yea.. chrome is strange sometimes. It shows the tokens when newly added.

@rp one more question I’ve. My client is hosted on x.test.com and backend is at auth.example.com

you need to set the samesite property of the cookie to

none

I guessed so. But that does raise few Infosec flags in our team. Got it.

Front token doesn’t contain anything sensitive