Problem with sending cookies

[MykytaLiashenko]

I have react-redux application and server on nodejs. I make authentication using jsonwebtoken. After I receive token on client side I put it inside httpOnly cookie. Next I make an authorized request to API with flag credentials : 'include', but I receive empty object instead of cookie on server.
I was trying twise. First on localhost ans second - using two aws ec2 instances. Same result - I can't get my cookie. I don't know is it an issue, but it could be and I want to know how to send cookie properly.

[dgraham]

An HttpOnly cookie may only be set by the server in an HTTP response. Client-side scripts cannot read or send HttpOnly cookies—they must be managed by the browser and server.

See #236, #163, and #138 for cookie discussions.

[MykytaLiashenko]

Thanks for your answer. Unfortunately,the problem is still not solved. I am setting cookies with res.cookie() on Node.JS server, then I make fetch with credentials : 'include' option and I have no cookie in request according to my server log.

[mislav]

I'm sorry that your problem isn't solved yet. The think with cookies is that their handling is left entirely by the browser. In browsers that support window.fetch natively, such as Chrome and Firefox at the time of this writing, cookies will be handled hopefully according to the WHATWG fetch spec. If you see that's not the case, then you'll have to take it with the respective browser's bug trackers.

In other browsers, such as Safari and IE, this polyfill will kick in and implement fetch using XMLHttpRequest as the underlying implementation. In this case, we also don't have any way of manipulating how cookies are handled— that is left entirely to the browser's implementation of XMLHttpRequest. So, it's very unlikely that this project (the polyfill) can break cookie handling because it never had any access to it in the first place.

Most people's problems with cookies in the past ultimately boiled down to their improper approach to cross-origin requests (CORS). If the requests that you're making with fetch are to another domain name (or a different port number even), you will have to double-check all the server headers that can affect CORS requests. Other than this, we can't really help you with this particular authentication problem. If everything else fails, you can always implement authentication not using cookies, but exchanging some kind of token manually via custom headers or URL query parameters.

[aqnaruto]

i agree with you ,CORS with cookie is never worked! @mislav @NikitaLiashenko