Search code examples
cookiestoken

"sharing" token cookie when using several http clients


I'm writing a VueJS application (so it runs on browser!)

I'm using Axios for a lot of rest api calls but when it comes to streaming, Axios does only provide some file streaming feature, not a feature like the one provided by stream-http. So I'm trying to use stream-http to manage long rest api calls in a somewhat stream mode.

Now the issue:

When I login, I do it with axios and receives the token cookie from the server. Subsequent calls to axios (using the withCredential option) send back the cookie to the server ==> it works. Traces on server side:

>headers { host: 'localhost:4000',
  'user-agent':
   'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',
  accept: 'application/json, text/plain, */*',
  'accept-language': 'fr-FR,fr;q=0.5',
  'accept-encoding': 'gzip, deflate',
  'access-control-allow-origin': '*',
  origin: 'http://localhost:8080',
  dnt: '1',
  connection: 'keep-alive',
  referer: 'http://localhost:8080/',
  cookie:
   'token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE2MjQxMjExMjEsImV4cCI6MTYyNDEyNDcyMX0.YaBZGlEC1MT-bMaDunHIEHTzLA4R9DLmq1WCk45cs9I',
  pragma: 'no-cache',
  'cache-control': 'no-cache' } 

But when I call a rest endpoint with stream-http, the cookie is not sent. Traces:

>headers { host: 'localhost:4000',
  'user-agent':
   'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',
  accept: '*/*',
  'accept-language': 'fr-FR,fr;q=0.5',
  'accept-encoding': 'gzip, deflate',
  'access-control-request-method': 'POST',
  'access-control-request-headers': 'access-control-allow-origin,content-type,set-cookie',
  referer: 'http://localhost:8080/',
  origin: 'http://localhost:8080',
  dnt: '1',
  connection: 'keep-alive',
  pragma: 'no-cache',
  'cache-control': 'no-cache' } 

As it's impossible to access the token in javascript in the browser (secure mode prevent it), I can't force it in stream-http calls. How to deal with this?


Solution

  • It appears:

    1. withCredential is set to false by default in stream-http
    2. RequestOptions (if you use typescript) in 'http' module does not contain withCredential field

    So I removed the type RequestOptions for the request() options and added withCredential: true in the options then it worked