External callbacks not redirecting correctly

[benquan]

I have a callback from google authentication using Lucia.

the callback calls the route:

/auth/callback/google/server.ts

I have simplified the endpoint to the bare minimum:

import type { RequestHandler } from './$types';
import { redirect } from 'sveltekit-flash-message/server';

export const GET: RequestHandler = async (event) => {
    throw redirect(
        303,
        '/',
        { type: 'success', message: 'Welcome' },
        event
    );
};

so google will respond with something like this:

http://localhost:5173/auth/callback/google?state=r5w7scpscva31xlqhm62c3c4f8x0urvw4ok&code=4%2F0AZEOvhVPlgoztB1YfZrhbAZrA8Ye-TxU-utPWUSeBymRLQOQXCzVGQS72EQ4gQ&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+openid&authuser=1&prompt=consent

When Google executes the callback The page gets forwarded to / but I do not get the flash message.

If i just copy the google link and paste it in the browser, then I get redirected to / and the flash message works.

Is there an issue with CORS or am I missing something?

Ben

[ciscoheat]

Could be, I'm not sure. The sameSite option could be related.

[benquan]

Used you example in #19 and it worked!

The code if anyone has a similar issue:

import { loadFlash, flashCookieOptions } from 'sveltekit-flash-message/server';

flashCookieOptions.sameSite = 'none';
flashCookieOptions.secure = true;

export const load = loadFlash(async ({ locals }) => {
    const ans = await locals.auth.validate();
    if (ans) return { user: ans.user };
});

[ciscoheat]

Great that it worked! Could you just check one thing: SvelteKit sets secure to true as default, can you remove that option and see if it still is secure? In that case, I'll update the docs.

[ciscoheat]

Or rather, it shouldn't be secure on localhost with http, but secure otherwise.

[benquan]

where would I set the option in Sveltekit?

[ciscoheat]

It's the default setting, so you just have to remove it, and see if it works both in dev and when built + https.

[benquan]

Ohh gotcha. But no, it does not work if I remove the line. Just checked in dev.

[ciscoheat]

Ok, probably because the Google url is https!