localhost development cookie issue

jacksontrevan

I am developing a SPA with react. I am having an issue while developing locally, i.e. on my localhost, the app is talking to FusionAuth and a service that is performing PKCE which are running remotely. I am having issues with the cookies being set. The cookies that are returned from the backend have a domain which is not localhost so they are dropped after the authentication and redirect.

How do I develop locally with this set-up, redirect back to localhost after authentication and retain the cookies?

vinicius.campitelli

@jacksontrevan

Hi there!

Can you please elaborate?

In the Authorization Code grant flow with PKCE:

Your backend generates a code challenge and a code verifier (which should be stored in your side, either in cookies or server session)
Your application takes the user to FusionAuth's /oauth2/authorize endpoint with redirect_url, code_challenge and other parameters
User logs in
FusionAuth redirects the user back to the provided redirect_url (your backend) with an authorization code
Your backend sends a request to FusionAuth's /oauth2/token endpoint with the received authorization code and the code verifier
FusionAuth compare code verifier and challenge and returns an access token
You can now use that access token to call your API or other resources

So which cookies are you trying to retrieve? In that flow, the backend would only need to store the code verifier in cookies during step 1.

jacksontrevan

@vinicius-campitelli The issue is with the our backend setting the final cookies, app.at, app.idt, app.at_exp in one domain after authentication, then having the application redirect back to localhost and retain the cookies. In other words I am trying to authenticate as a user and develop on localhost, however after authentication the cookies are no longer accessible when I redirect back to localhost.

dan

@jacksontrevan Yes, this is unfortunately a limitation of cookies.

You could work around that by setting up a DNS alias to local.example.com (assuming FusionAuth is running remotely at auth.example.com).

You can usually set that up by googling for local host in /etc/hosts <platform> which turns up: