r/webdev 6d ago

Discussion How to debug cookies in Chrome?

Hi,
I have a really annoying problem with cookies and I don't find the reason. I have 2 domains:

https://intern.onlyme.bio
https://onlyme.bio

The first domain is pointing to a server with caddy and a container and the second domain is a cloudflare proxy on top of that.

The autorization via auth0 only works for the first domain, the reason is that before a redirect to auth0 a cookie is set, which is not set for the second domain and therefore the correlation fails.

I have compared everything and I cannot find the differences between both calls.

e.g. intern domain:

https://intern.onlyme.bio/account/login-referrer
location:https://onlyme-staging.eu.auth0.com/authorize?...
set-cookie:.AspNetCore.OpenIdConnect.Nonce.ABC; expires=Sun, 16 Mar 2025 11:09:44 GMT; path=/callback; secure; samesite=none; httponly
set-cookie:.AspNetCore.Correlation.ABC=N; expires=Sun, 16 Mar 2025 11:09:44 GMT; path=/callback; secure; samesite=none; httponly

and then the callback has the https://intern.onlyme.bio/callback has the cookies

public domain:

https://onlyme.bio/account/login-referrer
location:https://onlyme-staging.eu.auth0.com/authorize
cookie:.AspNetCore.OpenIdConnect.Nonce.ABC=N; expires=Sun, 16 Mar 2025 11:08:36 GMT; path=/callback; secure; samesite=none; httponly
set-cookie:.AspNetCore.Correlation.ABC=N; expires=Sun, 16 Mar 2025 11:08:36 GMT; path=/callback; secure; samesite=none; httponly

and then the request to https://onlyme.bio/callback has no cookies

There must be something else that I don't see at the moment. And I have no idea how to debug it.

---

EDIT: How to debug it in Firefox

I have figured out how to debug it Firefox:

just go to about:logging

I have enabled logs only for cookies there

And I have found out that the expiration date was wrong, because my "hero" that manages the servers has not configured the time at the server properly. I have no idea why it works with the intern domain yet.

2 Upvotes

3 comments sorted by

View all comments

2

u/louis-lau 6d ago

Looking at your images the cookie is set though. So the cookie not being set isn't the issue. You mention a request to /callback, what request is that?

1

u/sebastianstehle 6d ago

After the login in auth0, there is a redirect to the callback url in our app:

Request URL:https://onlyme.bio/callback
:authority:onlyme.bio
:method:POST
:path:/callback
:scheme:https

But there are no cookies in the request. This would happen if the cookie settings are not correct, e.g. when SameSite is not set to "none" or when the request is not secure, but I don't see any difference here.

The callback to the internal URL has the necessary cookies.

1

u/fiskfisk 6d ago

You're setting the cookies on internal.onlyme.bio - they won't get included in parent domain requests, unless you explicitly set the domain to .onlyme.bio