0

In login implementation, backend API is redirecting user home page along with setting the session cookie. But when Browser invokes redirect request to home page, this cookie is not getting set-

Request URL: https://dfp.prod.us.abc.net/dfp/v1/login?code=D2AE706EBF9D4A15A23C0B0466D2243B&state=OneTwo
Status code: 302
Response headers:
Location: http://dfp-ui.prod.us.abc.net/
Set-Cookie: session-iam-token=MDUxODMyMDE41AQ71z4bAPXX0bvRUUOqdVIah==; Max-Age=1800; Expires=Tue, 10-Sep-2019 07:25:44 GMT; Domain=dfp-ui.prod.us.abc.net; Path=/

Now when browser redirects to http://dfp-ui.prod.us.abc.net/, this '

session-iam-token

is not getting send.

Abhijeet srivastava
  • 439
  • 4
  • 14
  • Of course, because you can't set cookies for another domain. You have an [XY problem](https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem). What problem are you trying to solve? Are you trying to accomplish Single Sign On? – CodeCaster Sep 10 '19 at 09:13
  • There is existing Cross cutting platform implementation, which requires request to be redirected to backend service- https://dfp.prod.us.abc.net/dfp/v1/login?code=D2AE706EBF9D4A15A23C0B0466D2243B&state=OneTwo Backend service then validate token(Query param code) and redirects to main page along with cookies generated from token. I do not get why domains are different, setting a cookie from dfp.prod.us.abc.net, and trying to access it from http://dfp-ui.prod.us.abc.net. – Abhijeet srivastava Sep 10 '19 at 09:19
  • Yeah sure, but that can't work if the hosts differ. "dfp.prod.us.abc.net" != "dfp-ui.prod.us.abc.net". If you're trying to reinvent Single Sign On, you're doing it wrong. – CodeCaster Sep 10 '19 at 09:22
  • So you are saying that cookies works only for same hosts? – Abhijeet srivastava Sep 10 '19 at 09:23
  • You can [set it for `prod.us.abc.net`](https://stackoverflow.com/questions/18492576/share-cookie-between-subdomain-and-domain), but not for a different subdomain. – CodeCaster Sep 10 '19 at 09:26

0 Answers0