Giter Site home page Giter Site logo

Comments (6)

adamw avatar adamw commented on August 17, 2024

It should be a matter of using usingHeaders instead of usingCookies in e.g. setSession. Does that work for you?

from akka-http-session.

ajazam avatar ajazam commented on August 17, 2024

I've done that and now the POST method returns a Set-Refresh-Token header. What I don't understand is why I'm still getting cookies when I've made the following change

def mySetSession(v: ExampleSession) = setSession(refreshable, usingHeaders, v)
val myRequiredSession = requiredSession(refreshable, usingHeaders)
val myInvalidateSession = invalidateSession(refreshable, usingHeaders)

When I access localhost:8080/ I get redirected to localhost:8080/site/index.html and also get the following cookie

Set-Cookie: "XSRF-TOKEN=8msbjnftu71rl48i0g7f9uis66hhue5ik91dtogap08r07us7qo0lj1fubjh7drs; Path=/"

Should I be getting cookies even though I've specified I'm using headers?

from akka-http-session.

adamw avatar adamw commented on August 17, 2024

Are you using the randomTokenCsrfProtection directive? If you are authenticating using headers, you are not vulnerable to CSRF attacks, so you don't need it

from akka-http-session.

ajazam avatar ajazam commented on August 17, 2024

I was using the randomTokenCrfsProtectiondirective. I also had to make the following change

              mySetSession(ExampleSession(body)) {
                //setNewCsrfToken(checkHeader) { ctx => ctx.complete("ok") }
                ctx => ctx.complete("ok")
              }

I am now receiving a Set-Authorization and Set-Refresh-Token headers as a response to the POST method. Am I correct to assume the session ID is returned bySet-Authorization and the value in Set-Refresh-Token is always returned back to the website?

from akka-http-session.

adamw avatar adamw commented on August 17, 2024

Yes. The Set-Refresh-Token is used to implement "remember me", as described here: https://github.com/softwaremill/akka-http-session#refresh-tokens-remember-me

from akka-http-session.

ajazam avatar ajazam commented on August 17, 2024

Thank you

from akka-http-session.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.