aofei / air

An ideally refined web framework for Go.
https://pkg.go.dev/github.com/aofei/air
MIT License
441 stars 37 forks source link

Cookies Go Missing when they're set before a redirect #18

Closed SaulDoesCode closed 5 years ago

SaulDoesCode commented 5 years ago
air.GET("/auth/:verifier", func(req *air.Request, res *air.Response) error {
    user, err := VerifyUser(req.Param("verifier").Value().String())
    if err != nil || user == nil {
        if DevMode {
            fmt.Println("Unable to Authenticate user: ", err)
        }
        return UnauthorizedError.Send(res)
    }

    newtoken, err := GenerateAuthToken(user, false)
    if err == nil {
// This Cookie never reaches the client
        res.SetCookie("Auth", &air.Cookie{
            Value:    newtoken,
            Path:     "/",
            MaxAge:   60 * 60 * 24 * 7,
                        Domain: AppDomain,
            HTTPOnly: !DevMode,
            Secure:   !DevMode,
        })
    } else {
        if DevMode {
            fmt.Println("error verifying the user, GenerateAuthToken db problem: ", err)
        }
    }

    if user.isAdmin() {
        return res.Redirect("/admin")
    }
    return res.Redirect("/")
})

the problem is probably somewhere in res.Write, but it looks like the Header application step of serving is ignored when content io.ReadSeeker is nil, or something else is happening, not sure. But I need cookies to set on redirects, it worked in echo, it should work here.

aofei commented 5 years ago

I think this problem may be caused by the status 302 that Air automatically sets. See https://stackoverflow.com/a/4696017/5801959.

aofei commented 5 years ago

I tested it. It works fine in Chrome. But can't in Safari.

aofei commented 5 years ago

See request/request#1502.

SaulDoesCode commented 5 years ago

I tested it just now, and it seems if you use *http.Cookie and the conventional go way of setting cookies, then this problem is solved. The handler above works in mak for some reason.