[BUG] error "unauthorized" reason "_reader access is required for this request"

[Erudition]

Statement of purpose I'm trying to access my couchdb database. I successfully authenticated using Cookie authentication, but the response to that is:

19:34:39.870 XHRPOST
https://512940bf-6e0c-4d7b-884b-9fc66185836b-bluemix.cloudant.com/_session

[HTTP/1.1 200 OK 0ms]
{"roles":[],"ok":true,"name":"tuddereartheirceirleacco"}

As you can see, I have no roles, which explains the problem below.

I do solemnly swear (or affirm) that this is an API bug, and not a Marvin bug. For Marvin bugs I would use the in-app "?→Contact Support" feature

Describe the bug When accessing the database, I get the error that I don't have "_reader" access.

Endpoint(s) in question e.g. /{db}

Expected behavior According to the CouchDb docs, a successful GET request to the /{db} endpoint should return information like this:

HTTP/1.1 200 OK
Cache-Control: must-revalidate
Content-Length: 258
Content-Type: application/json
Date: Mon, 12 Aug 2013 01:38:57 GMT
Server: CouchDB (Erlang/OTP)

{
    "cluster": {
        "n": 3,
        "q": 8,
        "r": 2,
        "w": 2
    },
    "compact_running": false,
    "db_name": "receipts",
    "disk_format_version": 6,
    "doc_count": 6146,
    "doc_del_count": 64637,
    "instance_start_time": "0",
    "props": {},
    "purge_seq": 0,
    "sizes": {
        "active": 65031503,
        "external": 66982448,
        "file": 137433211
    },
    "update_seq": "292786-g1AAAAF..."
}

HTTP client: Using the browser, Elm programming language (-> Javascript).

Additional context I see the problem in the browser console.

Though I successfully authenticated, it seems the username given to me has no "roles" set, so I cannot actually do anything.

[amazingmarvin]

@Erudition Does cloud sync work for you in Marvin?

[amazingmarvin]

I am also seeing roles: [] in the /_session response so it doesn't seem to be particular to your sync account. Make sure the cookie is being sent with your requests (or just use the Authorization header).

[Erudition]

While I cannot access the cookie from my code, the server response does include the Set-Cookie header so I assume it is sent (implicitly by the browser) with every subsequent request I make, no?

{"roles":[],"ok":true,"name":"tuddereartheirceirleacco"}

But yes, the Marvin frontend does seem to sync most of the time.

[amazingmarvin]

At least in the cases of chrome and firefox, the browser shows you which cookies it's sending. It's a SameSite=None cookie so make sure you're connecting with https. Try using basic auth if you can't get cookies to work.