Can't Provide sameSite: "none" in cookieOptions

[vvo]

Can't Provide sameSite: "none" in cookieOptions

[vvo]

Hey @prantadutta, what does sameSite: "none" as "none", means? Why not just "none"?

Also is teems sameSite: none is only compatible with secure cookies (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)

Can you create a repository reproducing your issue? With the smallest amount of context/code as possible.

Then share it and we can work on it.

[theprantadutta]

Hey @prantadutta, what does sameSite: "none" as "none", means? Why not just "none"?

I am using typescript and for some reason, it doesn't accept just "none". The same applies to "strict" and "lax" too.

[theprantadutta]

Also is teems sameSite: none is only compatible with secure cookies (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)

Okay, But I am on localhost. So how do I use "none" now.

[vvo]

Okay, But I am on localhost. So how do I use "none" now.

I have no idea, sorry. It says you can't use samesite none if cookie is not secure, never tried it though.

"write after end" usually means there's some res.write call being made after the response was already sent. But why is it working on sameSite not none, no idea.

You can get an https website locally: https://dev.to/rhymes/really-easy-way-to-use-https-on-localhost-341m

good luck!

[theprantadutta]

Thanks, maybe I have to go deeper...Although checkout that typescript "none" issue.

[theprantadutta]

Sorry, I had to re-open this issue. It turned this problem still exists in https.
My config:

   export const NEXT_IRON_SESSION_CONFIG = {
      cookieName: "grayscale",
      cookieOptions: {
        httpOnly: true,
        secure: isProduction,
        sameSite: "strict" as "strict",
        // sameSite: "none" as "none",
        maxAge: 60 * 60, // 2 hours
        path: "/",
      },
      password: process.env.APPLICATION_SECRET!,
    };

And this api is giving me the error.

    export default handler.post(async (req, res) => {
      const { data } = req.body;
    
      await applySession(req, res, NEXT_IRON_SESSION_CONFIG);
    
      if (data) {
        (req as any).session.set("user", data);
      } else {
        (req as any).session.unset("user");
      }
      await (req as any).session.save();
      res.end();
    });

I am really lost right now...

[theprantadutta]

@vvo hello, r u there?

[vvo]

@prantadutta Please create a GitHub repository where I can run npm install && npm run dev.

This GitHub repository should be the next-iron-session example (https://github.com/vvo/next-iron-session/tree/master/examples/next.js) with as few changes as possible to consistently reproduce your issue.

By doing so, you might see a time where this issue starts to trigger (maybe when adding some modules).

Once I can reproduce your issue we can see what's wrong maybe.

Thanks.

[theprantadutta]

@vvo The GitHub example is working as expected. Maybe I need to change my code somewhere.

[theprantadutta]

@vvo I can't really figure out what's the problem here...So here's the github repo of my project. It would be really helpful if you take a look.

Also, when I am in HTTPS, I can't really use the API at all. It throws me the unhandled error. But when I am on HTTP, I can use the API with my original cookie options.

[theprantadutta]

hi @vvo did you take a look? what am I doing wrong? it's still crashing my server again and again...please reply..

[vvo]

Hey, @prantadutta I can't test your GitHub repository because it contains too much "noise" (differences with the basic example of next-iron-session). This would take me way too long to figure it out.

As you said, it's working with the GitHub example so most probably there's an issue somewhere with your local certificates and/or code. You can try to removing bits by bits code from your GitHub repo and see when it works, this way you'll get the minimum reproducible code to showcase your bug, which will help you no matter what.

I suggest you use StackOverflow for this kind of help and wish you good luck.

Hope you understand my position here.

[vvo]

closing for inactivity