title: How to fix 'http: named cookie not present' in golang?
body: <p>I'm building a small dinner/plan management application (with the use of microservices) for a couple of people I know. The intention is that each person can login to their own account and can then authenticate to other services using a bearer token (JWT).</p>
  
  <p>This bearer token is stored in a cookie. However, I cannot find this cookie after it has been set and I try to retrieve it again.</p>
  
  <p>Which eventually results in the error </p>
  
  <pre><code>http: named cookie not present
  </code></pre>
  
  <p>Why is the response body of the request empty? 
  Why aren't there any cookies sent with my GET request? 
  How can I go about fixing this?</p>
  
  <hr>
  
  <p>I've searched around the net for a bit and tried the following things</p>
  
  <ul>
  <li><p><strong>Net/http cookie</strong>:
  The implementation that seems the most simple, and also the one that I'm showing here. It seems like this trivial example should work.</p></li>
  <li><p><strong>Cookiejar implementation</strong>:
  I tried to use the cookiejar implementation to set and retrieve the cookies from both the browser and postman, however it resulted in the same outcome. The cookiejar implementation I used is described in <a href="https://golang.org/pkg/net/http/cookiejar/?m=all#New" rel="nofollow noreferrer">https://golang.org/pkg/net/http/cookiejar/?m=all#New</a></p></li>
  <li><p><strong>Setting to specific URL and extra GET request</strong>:
  I tried to place the cookies on a different specific URL within my domain. At some point it seemed like the cookies could only be retrieved from a certain specific absolute URL, this was not the case.</p></li>
  <li><p><strong>httputil DumpRequestOut</strong>:
  I found that the utility package of net/http had a function called DumpRequestOut, this function might have been able to extract the body from the request, but this was also empty.</p></li>
  <li><p><strong>Setting cookie 'secure' flag to false</strong>:
  I found a suggestion that the secure flag makes the cookies impossible to read. Unfortunately changing the secure flag had no effect.</p></li>
  </ul>
  
  <hr>
  
  <p>Postman clearly shows that the cookies do exist. My browser (firefox) also shows that the cookies exist, but they have been given quite an abstract name.
  The Postman requests can be found at <a href="https://www.getpostman.com/collections/fccea5d5dc22e7107664" rel="nofollow noreferrer">https://www.getpostman.com/collections/fccea5d5dc22e7107664</a>  </p>
  
  <p>If I try to retrieve the cookies using the "net/http" package from golang, the response body comes up empty.</p>
  
  <p>I set the session tokens and redirect the client directly after I've authenticated the user/password combination.</p>
  
  <pre class="lang-golang prettyprint-override"><code>// SetTokenAndRedirect sets an access token to the cookies
  func SetTokenAndRedirect(w http.ResponseWriter, r *http.Request, db *mgo.Session, u *user.User, redirectURL string) *handler.AppError {
      // Generate a unique ID for the session token.
      tokenID := uuid.Must(uuid.NewV4()).String()
      //set the expiration time (found in config.config.go)
      expirationTime := time.Now().Add(config.ExpireTime)
      // Set the cookie with the JWT
      http.SetCookie(w, &amp;http.Cookie{
          Name:     config.AccessTokenName,
          Value:    createToken(u.UserID, expirationTime, tokenID, r.Header.Get("User-Agent")),
          Expires:  expirationTime,
          HttpOnly: true,
          Secure:   false,
      })
  
      // Redirects user to provided redirect URL
      if redirectURL == "" {
          return handler.AppErrorf(417, nil, "No redirect URL has been provided")
      }
      http.Redirect(w, r, redirectURL, 200)
      return nil
  }
  </code></pre>
  
  <p>I try to verify the incoming request and JWT token as follows.</p>
  
  <pre class="lang-golang prettyprint-override"><code>// All handlers will have this adapted serveHTTP function 
  func (fn AppHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
      if err := Authorize(w, r); err != nil {
          http.Error(w, fmt.Sprintf("Not Authorized: %v", err), http.StatusUnauthorized)
          return
      }
      if e := fn(w, r); e != nil { // e is *appError, not os.Error.
          log.Printf("Handler error: status code: %d, message: %s, underlying err: %#v",
              e.Code, e.Message, e.Error)
  
          http.Error(w, e.Message, e.Code)
      }
  }
  </code></pre>
  
  <pre class="lang-golang prettyprint-override"><code>// Claims defines what will be stored in a JWT access token
  type Claims struct {
      ProgramVersion string `json:"programVersion"`
      UserAgent      string `json:"userAgent"`
      jwt.StandardClaims
  }
  
  // Authorize checks if the jwt token is valid
  func Authorize(w http.ResponseWriter, r *http.Request) error {
      c, err := r.Cookie("access_token")
      if err != nil {
          if err == http.ErrNoCookie {
              // The program returns this error
              return err
          }
          return err
      }
  
      tokenString := c.Value
  
      claim := &amp;Claims{}
  
      tkn, err := jwt.ParseWithClaims(tokenString, claim, func(tkn *jwt.Token) (interface{}, error) {
          return config.JwtSigningSecret, nil
      })
      if !tkn.Valid {
          return err
      }
      if err != nil {
          if err == jwt.ErrSignatureInvalid {
              return err
          }
          return err
      }
  
      // JWT token is valid
      return nil
  }
  
  </code></pre>
  
  <hr>
  
  <p>The request is structured as follows when <strong>setting the cookie</strong></p>
  
  <pre class="lang-sh prettyprint-override"><code>// Pretty printed version
  Host: localhost:8080
  content-type: application/json
  user-agent: PostmanRuntime/7.11.0
  cache-control: no-cache
  accept-encoding: gzip, deflate
  content-length: 68
  connection: keep-alive
  accept: */*
  postman-token: 36268859-a342-4630-9fb4-c286f76d868b
  cookie: access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwcm9ncmFtVmVyc2lvbiI6IjEuMC4wIiwidXNlckFnZW50IjoiUG9zdG1hblJ1bnRpbWUvNy4xMS4wIiwiZXhwIjoxNTU2MjA0MTg3LCJqdGkiOiJlZDlmMThhZi01NTAwLTQ0YTEtYmRkZi02M2E4YWVhM2M0ZDEiLCJpYXQiOjE1NTYyMDM1ODcsImlzcyI6ImdrLmp3dC5wcm9maWxlU2VydmljZS5hIn0.bssnjTZ8woKwIncdz_EOwYbCtt9t6V-7PmLxfq7GVyo
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>// Raw Version
  &amp;{POST /auth/users/login?redirect=/ HTTP/1.1 1 1 map[Cache-Control:[no-cache] Postman-Token:[d33a093e-c7ab-4eba-8c1e-914e85a0d289] Cookie:[access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwcm9ncmFtVmVyc2lvbiI6IjEuMC4wIiwidXNlckFnZW50IjoiUG9zdG1hblJ1bnRpbWUvNy4xMS4wIiwiZXhwIjoxNTU2MjA0NDU4LCJqdGkiOiIzOTk1MmI1NS0yOWQzLTQ4NGQtODhhNC1iMDlhYmI1OWEyNzgiLCJpYXQiOjE1NTYyMDM4NTgsImlzcyI6ImdrLmp3dC5wcm9maWxlU2VydmljZS5hIn0.DFA7KBET3C2q1A9N1hXGMT0QbabHgaVcDBpAYpBdbi8] Accept-Encoding:[gzip, deflate] Connection:[keep-alive] Content-Type:[application/json] User-Agent:[PostmanRuntime/7.11.0] Accept:[*/*] Content-Length:[68]] 0xc0001ba140 &lt;nil&gt; 68 [] false localhost:8080 map[redirect:[/]] map[] &lt;nil&gt; map[] [::1]:36584 /auth/users/login?redirect=/ &lt;nil&gt; &lt;nil&gt; &lt;nil&gt; 0xc00016a2a0}
  </code></pre>
  
  <p>The request is structured as follows when <strong>getting the cookie</strong></p>
  
  <pre class="lang-sh prettyprint-override"><code>// Pretty printed version
  Host: localhost:8080
  cache-control: no-cache
  postman-token: 20f7584f-b59d-46d8-b50f-7040d9d40062
  accept-encoding: gzip, deflate
  connection: keep-alive
  user-agent: PostmanRuntime/7.11.0
  accept: */*
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>// Raw version
  2019/04/25 12:22:56 &amp;{GET /path/provide HTTP/1.1 1 1 map[User-Agent:[PostmanRuntime/7.11.0] Accept:[*/*] Cache-Control:[no-cache] Postman-Token:[b79a73a3-3e08-48a4-b350-6bde4ac38d23] Accept-Encoding:[gzip, deflate] Connection:[keep-alive]] {} &lt;nil&gt; 0 [] false localhost:8080 map[] map[] &lt;nil&gt; map[] [::1]:35884 /path/provide &lt;nil&gt; &lt;nil&gt; &lt;nil&gt; 0xc000138240}
  </code></pre>
  
  <p>The response is structured as follows when <strong>setting the cooke</strong></p>
  
  <pre class="lang-sh prettyprint-override"><code>response Headers: map[Location:[/] Set-Cookie:[access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwcm9ncmFtVmVyc2lvbiI6IjEuMC4wIiwidXNlckFnZW50IjoiR28taHR0cC1jbGllbnQvMS4xIiwiZXhwIjoxNTU2MjI4ODIyLCJqdGkiOiJlY2Q2NWRkZi1jZjViLTQ4N2YtYTNkYy00NmM3N2IyMmUzMWUiLCJpYXQiOjE1NTYyMjgyMjIsImlzcyI6ImdrLmp3dC5wcm9maWxlU2VydmljZS5hIn0.0sOvEzQS2gczjWSmtVSD_u0qMV2L7M4hKF1KUM08-bQ; Expires=Thu, 25 Apr 2019 21:47:02 GMT; HttpOnly] Date:[Thu, 25 Apr 2019 21:37:02 GMT] Content-Length:[0]]
  </code></pre>
  
  <hr>
  
  <p>I expect that the Authorize function will return nil. Also,if I add the following piece of code I expect that there are some cookies present.</p>
  
  <pre class="lang-golang prettyprint-override"><code>for _, cookie := range r.Cookies() {
      fmt.Fprint(w, cookie.Name)
  }
  </code></pre>
  
  <p>However, the Authorize function returns the error in the title and the printf does not print out any cookies.</p>