Allow auth webhook to set cookies on response #2269
Description
Hasura does not currently (unless I'm doing something wrong) forward the Set-Cookie header from auth webhooks. This issue is similar to but different from #1654
Use cases:
- Setting a tracking cookie on unauthenticated requests
- Resetting cookie maxAge on each request. This would be very useful for cookies that expire within a set, short amount of time.
One option would be to forward the Set-Cookie header set by auth webhook to the response.
Another, more explicit option would be for the webhook to explicitly respond with a cookies object, and for those to be set on the response.
Here are two possible syntaxes for the auth webhook response:
{
"X-Hasura-User-Id": "25",
"X-Hasura-Role": "user",
"X-Hasura-Is-Owner": "true",
"X-Hasura-Custom": "custom value",
"Cookies": {
"<cookie-name>": {
"Value": "<cookie-value>",
"Expires": "<date>"
"Max-Age": <non-zero-digit>,
"Domain": "<domain-value>",
"Path": "<path-value>",
"Secure": <boolean>,
"HttpOnly": <boolean>,
"SameSite": "<Strict/Lax>"
}
},
"Cookies": [
{
"Name": "<cookie-name>",
"Value": "<cookie-value>",
"Expires": "<date>"
"Max-Age": <non-zero-digit>,
"Domain": "<domain-value>",
"Path": "<path-value>",
"Secure": <boolean>,
"HttpOnly": <boolean>,
"SameSite": "<Strict/Lax>"
}
]
}
Another, even more general purpose way would be to allow a special headers property. This would allow the webhook to set any header. Example syntaxes:
{
"X-Hasura-User-Id": "25",
"X-Hasura-Role": "user",
"X-Hasura-Is-Owner": "true",
"X-Hasura-Custom": "custom value",
"Response-Headers": [
{
"name": "Set-Cookie",
"value": "<cookie-name>=<cookie-value>; Expires: <date>; Max-Age: <non-zero-digit>; Domain: <domain-value>; Path: <path-value>; Secure: <boolean>; HttpOnly: <boolean>; SameSite: <Strict/Lax>",
}
],
"Response-Headers": [
"Set-Cookie: <cookie-name>=<cookie-value>; Expires: <date>; Max-Age: <non-zero-digit>; Domain: <domain-value>; Path: <path-value>; Secure: <boolean>; HttpOnly: <boolean>; SameSite: <Strict/Lax>",
]
}
Metadata
Metadata
Assignees
Labels
Issues related to "authentication" and capturing session claims from an API callRelated to servercan be wrapped up in few hoursNew feature or improve an existing featurecandidate for being included in the upcoming sprintnon-urgent issues/features that are candidates for being included in one of the upcoming sprints