Unleash-Session Cookie Sent In Headers #8029
Comments
|
Hi there, |
|
Hi @ivarconr, |
|
Hi, I tested this on our demo instance, and I was not able to reproduce your issue using curl. When looking at the error "InvalidTokenError" it actually tries to parse the token, but it is not considered correct type. The most likely reason is that you are trying to use a "client" token and not a "frontend" token. Can you please verify that the token is a "frontend token"? |
|
@ivarconr |
|
Can you please answer these:
|
|
Hi @ivarconr ;)
|
|
Are you able to reproduce it on demo? |
|
HI @ruthChavshush I'll try to reproduce it myself, but I see the curl command you're sending is not well formed as it's not identifying your authorization header (based on the response from the server) and there are some weird characters there that I think they result in your command output things like Also, what SDK are you using in your web application? You didn't mention much about it |
|
Ok, I was able to reproduce, tomorrow I'll dive deeper. First call using the cookie after I signed up to Unleash in the same domain, I get invalid token. Second request modifying the cookie to something invalid, it works fine. Third attempt removing the cookie, it also works fine. To test I used this: https://github.com/gastonfournier/sample-same-domain-cookie-issue Below you can see the output: ~ $ curl 'http://127.0.0.1:8080/unleash/api/frontend?sessionId=589979054&appName=frontend-app-test&environment=development' -H 'Accept: application/json' -H 'Authorization: *:development.4bc3d433ea828c4d4cbd3b1dda5eeebed14fd2533fad157f833c9234' -H 'Cookie: unleash-session=s%3ATCpF4mRLaC4gT5GINPYnMKEYk3NuuonY.T%2Beis3ZiB9Od0m%2FYfE8RiI5sN5LeNnYoKvePamXXYWc' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' | jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 150 100 150 0 0 22029 0 --:--:-- --:--:-- --:--:-- 25000
{
"id": "7ba73cac-c323-4482-a246-dcfdb03c8603",
"name": "InvalidTokenError",
"message": "Token was not valid",
"details": [
{
"message": "Token was not valid"
}
]
}
~ $ curl 'http://127.0.0.1:8080/unleash/api/frontend?sessionId=589979054&appName=frontend-app-test&environment=development' -H 'Accept: application/json' -H 'Authorization: *:development.4bc3d433ea828c4d4cbd3b1dda5eeebed14fd2533fad157f833c9234' -H 'Cookie: unleash-session=INVALID' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' | jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 158 100 158 0 0 61936 0 --:--:-- --:--:-- --:--:-- 79000
{
"toggles": [
{
"name": "test",
"enabled": true,
"variant": {
"name": "disabled",
"enabled": false,
"feature_enabled": true,
"featureEnabled": true
},
"impressionData": false
}
]
}
~ $ curl 'http://127.0.0.1:8080/unleash/api/frontend?sessionId=589979054&appName=frontend-app-test&environment=development' -H 'Accept: application/json' -H 'Authorization: *:development.4bc3d433ea828c4d4cbd3b1dda5eeebed14fd2533fad157f833c9234' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' | jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 158 100 158 0 0 54146 0 --:--:-- --:--:-- --:--:-- 79000
{
"toggles": [
{
"name": "test",
"enabled": true,
"variant": {
"name": "disabled",
"enabled": false,
"feature_enabled": true,
"featureEnabled": true
},
"impressionData": false
}
]
} |
|
@gastonfournier Thank you, it is resolved🔥 |
Describe the bug
Hi:)
We are having the bug that I saw this issue opened about.
Opening Unlish and the application in the same domain returns a 401 error for the toggle request. Because the Cookie header has been sent.
I tried to use the customHeaders property to override the value in the cookie header but it doesn't seem to help and it still uses the cookie.
Is this bug known and have you fixed it?
And do you have a suggestion how to deal with it in the meantime
Thanks in advance!!
Steps to reproduce the bug
Expected behavior
When using unleash token, i dont want the session cookie to be sent as well.
Logs, error output, etc.
No response
Screenshots
Additional context
No response
Unleash version
No response
Subscription type
None
Hosting type
Self-hosted
SDK information (language and version)
React v4
The text was updated successfully, but these errors were encountered: