authorization error due to pouchdb change

[barbalex]

Case

This is an issue in PouchDB and https://github.com/pouchdb-community/pouchdb-authentication that raises issues for people using rxdb.

I am raising this here to inform others that may run into this.

There is a workaround described here: pouchdb-community/pouchdb-authentication#239 (comment) that could maybe be applied to rxdb for as long as the issues in PouchDB and pouchdb-authentication are not resolved.

Related issues:

• PouchDB 7.0.0 breaks cookie authentication pouchdb/pouchdb#7390
• (#7391) - Restore default of sending credentials with fetch requests pouchdb/pouchdb#7395
• feat(pouchdb): support pouchdb 7.0.0 [WORK IN PROGRESS - DO NOT MERGE] pouchdb-community/pouchdb-authentication#238

Issue

Authorization using cookies does not work.

Info

• Environment: browser
• Adapter: http
• Stack: rxdb using https://github.com/pouchdb-community/pouchdb-authentication to create a cookie to authenticate users

Code

this sync:

userDb.user.sync({
      remote: `http://localhost:5984/user_test_at_test_p_ch/`,
      options: {
        live: true,
        retry: true,
      },
      query: userDb.user
        .find()
        .where('type')
        .eq('user'),
    })

results in:

http://localhost:5984/user_test_at_test_p_ch/ 401 (Unauthorized)

after logging in:

import PouchDB from 'pouchdb-browser'
import pouchdbAuthentication from 'pouchdb-authentication'

PouchDB.plugin(pouchdbAuthentication)

const authDb = new PouchDB(couchUrl())
await authDb.logIn(email, password)

[barbalex]

I tried forcing pouchdb and rxdb to always include credentials:

PouchDB.defaults({
  fetch(url: any, opts: any) {
    opts.credentials = 'include'
    return (PouchDB as any).fetch(url, opts)
  },
} as PouchDB.Configuration.RemoteDatabaseConfiguration)

and:

 await userDb.collection({
  name: 'user',
  schema: userDocSchema,
  pouchSettings: {
    fetch(url: any, opts: any) {
      opts.credentials = 'include'
      return (PouchDB as any).fetch(url, opts)
    },
  } as PouchDB.Configuration.RemoteDatabaseConfiguration,
})

but that does not solve the issue.

[pubkey]

A quick workaround could be to remove rxdbs pouchdb-folder and install an older version of pouchdb.

[barbalex]

even though it would be a breaking change before? (v6.x versus v7)

[barbalex]

I tried installing [email protected] and enforcing it's use by adding it as resolution in package.json (using yarn). But cookies are still not sent.

[barbalex]

Went back to [email protected] and [email protected]. Still no cookies sent.

Then I deleted the pouchdb-js file in node_modules/rxdb/dist/lib/ and also in the src folder. Still no cookies sent.

My only temporary but horrible hack is to not write members into the security docs of the databases I am working with. Hoping that this will all work, once pouchdb and pouchdb-authentication update.

This is now o.k. for me as this app is in development and not used in real life yet.

[pubkey]

I'm closing this. It should be fixed by the authentication-plugin, not by RxDB.

[psolom]

@barbalex have you found a workaround?

[barbalex]

@servocoder nope, sadly not. I'm waiting for pouchdb and the authentication-plugin to solve it.

[hubgit]

I've been able to work around this, not by setting pouchSettings.fetch as the RxDatabaseCreator types would suggest (which had no effect), but by setting fetch as a sync option:

collection.sync({
    options: {
        fetch: (url, opts) => PouchDb.fetch(url, {
            ...opts,
            credentials: 'include',
        })
    },
})