search

clerk / clerk-sdk-go

Access the Clerk Backend API from Go
MIT License
94 stars 21 forks source link

Ability to skip cookie validation in middleware #129

Open odannyc opened 1 year ago

odannyc commented 1 year ago

We currently use graphql for all of our requests from frontend (nextjs and react native) to our backend (Go). We explicitly add the Authorization header to all those requests, so no need to do the cookie verification in the middleware. This is also causing issues for us because when we use graphiql everything comes back as 401 and we're unable to send debug requests through that tool.

Ideally we could simply add an "Option" (WithSkipCookieVerification): https://github.com/clerkinc/clerk-sdk-go/blob/98a655dfd24721353e05027bece746304748399b/clerk/middleware_v2.go#L46

Thanks

dimkl commented 1 year ago

Hello @odannyc Checking the middleware_v2.go file (from the link you provided in the description) you can see that the 1st check the middleware does is for authentication header and then checks for cookies. If you have added an Authorization header to the request (the cookies wont be processed) and it will only return 401 if the verification fails for the provided token. Is it possible that you provide an expired or invalid token in your debug requests? If you want to send un-authorized requests for debugging purposes then i would suggest you move the endpoints to another route that the middleware does not run or use a wrapper of middleware to conditional trigger the Clerk middleware based on the route. I cannot find a reason for WithSkipCookieVerification to be implemented. Could you provide a code example of the issue described and more information?

odannyc commented 1 year ago

With GraphQL I only have 1 endpoint (/graph). That endpoint can accept unauthorized requests (Without the Authorization header), and this is when it fails always, because it can't find the auth header and it cant find the session cookies. I don't want the middleware to fail my requests if the cookie isn't found.

IGassmann commented 1 year ago

We're encountering the same issue.

With GraphQL I only have 1 endpoint (/graph). That endpoint can accept unauthorized requests (Without the Authorization header), and this is when it fails always, because it can't find the auth header and it cant find the session cookies. I don't want the middleware to fail my requests if the cookie isn't found.

gkats commented 9 months ago

I'm not sure if this helps, but the new v2 version of the library provides a middleware that only checks for bearer token authentication, with the Authorization header.

https://pkg.go.dev/github.com/clerk/clerk-sdk-go/v2/http

matthewshirley commented 8 months ago

Are there plans to support cookies again?

gkats commented 8 months ago

Are there plans to support cookies again?

Hi, @matthewshirley, yes, we do have plans for supporting cookie-based authentication again in v2.

We decided to release v2 without it because usage wasn't that high. It's definitely on our roadmap though.

If you don't mind me asking, what's your setup like?

matthewshirley commented 8 months ago

@gkats That's great, thank you! The setup is an SSR Go app using HTMX.

zakpaw commented 6 months ago

Hi @gkats, I have the same scenario with SRR go app, would you mind sharing what's the progress on cookie-based auth for v2? Should I just use v1?

gkats commented 5 months ago

would you mind sharing what's the progress on cookie-based auth for v2?

Hi @zakpaw, unfortunately priorities have shifted and cookie based support for v2 of our Go SDK is not at the top of the list.

I don't think I can provide an ETA, so in the meantime my suggestion would be to use v1. Really sorry I don't have better news to share.