{"action":"created","issue":{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/143","repository_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie","labels_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/143/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/143/comments","events_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/143/events","html_url":"https://github.com/hapijs/hapi-auth-cookie/issues/143","id":177664779,"number":143,"title":"Cookie not being set? ","user":{"login":"PWAckerman","id":11021252,"avatar_url":"https://avatars.githubusercontent.com/u/11021252?v=3","gravatar_id":"","url":"https://api.github.com/users/PWAckerman","html_url":"https://github.com/PWAckerman","followers_url":"https://api.github.com/users/PWAckerman/followers","following_url":"https://api.github.com/users/PWAckerman/following{/other_user}","gists_url":"https://api.github.com/users/PWAckerman/gists{/gist_id}","starred_url":"https://api.github.com/users/PWAckerman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PWAckerman/subscriptions","organizations_url":"https://api.github.com/users/PWAckerman/orgs","repos_url":"https://api.github.com/users/PWAckerman/repos","events_url":"https://api.github.com/users/PWAckerman/events{/privacy}","received_events_url":"https://api.github.com/users/PWAckerman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-18T17:28:49Z","updated_at":"2016-09-18T17:57:01Z","closed_at":null,"body":"I have an API written with Hapi using hapi-auth-cookie that interacts with a few different front ends. I have isHttpOnly and isSecure turned on (API is only accessible through SSL/TLS). The login from my Ionic application (running on iOS), a Chrome Plugin, and even from POSTMAN work correctly, the cookie is set on the request object and I can verify its there before the request is sent (and I have an 'authed' endpoint to double check that the client has been authenticated correctly after the fact) and all subsequent requests are properly validated. However, when I try to login from a web application running in the Chrome browser (have not tried any other browsers), the cookie does not get set.\r\n\r\nPart of the sequence for adding the cookie is this:\r\n\r\n    request.cookieAuth.set({ sid: sid });\r\n    console.log('set cookieAuth');\r\n    console.log('request', request.headers);\r\n\r\nso that I can inspect the headers once cookieAuth has been set. For all of the successful client-side applications, I can see the cookie as part of the headers when I do the logging after `cookieAuth.set` has been called. It will look something like: \r\n\r\n`cookie: 'sid=Fe26.2**e209400ebf6630d9d1f2d01d4ed5b49f116860cf8429d6ea244955087f3481f6*Tnp8Ou9BUGJcYqLxZEtsBQ*o_zXBoiNuwztdGockACNcRVllIs4pllAAKlKwXxeBn0**98506838190eb8c4f3b1989b530149f28f366db733fa75edf4fff4bca858928e*sJUjACyVv7CsEEkkHbx2ze1byRcJZ3ssyNk8Vz-ndwA'`\r\n\r\nHowever, when I try to do authentication/authorization to the same `login` endpoint from the browser-based web application, with the same sequence of code, `cookie` is not even listed among the headers when I do the logging after `request.cookieAuth.set({ sid: sid });`. I can't understand why there would be different behavior."},"comment":{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/comments/247862675","html_url":"https://github.com/hapijs/hapi-auth-cookie/issues/143#issuecomment-247862675","issue_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/143","id":247862675,"user":{"login":"devinivy","id":3150233,"avatar_url":"https://avatars.githubusercontent.com/u/3150233?v=3","gravatar_id":"","url":"https://api.github.com/users/devinivy","html_url":"https://github.com/devinivy","followers_url":"https://api.github.com/users/devinivy/followers","following_url":"https://api.github.com/users/devinivy/following{/other_user}","gists_url":"https://api.github.com/users/devinivy/gists{/gist_id}","starred_url":"https://api.github.com/users/devinivy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devinivy/subscriptions","organizations_url":"https://api.github.com/users/devinivy/orgs","repos_url":"https://api.github.com/users/devinivy/repos","events_url":"https://api.github.com/users/devinivy/events{/privacy}","received_events_url":"https://api.github.com/users/devinivy/received_events","type":"User","site_admin":false},"created_at":"2016-09-18T17:57:01Z","updated_at":"2016-09-18T17:57:01Z","body":"That header is a request header sent by the client.  Can you provide the response `set-cookie` header for the request during which cookies are set?  For a start, you might have an issue making AJAX calls without setting `withCredentials`, or hapi's new behavior (in v15) around using `SameSite` cookies by default might be causing you trouble.  Here are the v15 release notes for reference: https://github.com/hapijs/hapi/issues/3323"}}
{"actor":{"display_login":"devinivy"}}