cmp-cc / vue-cookies

A simple Vue.js plugin for handling browser cookies
MIT License
408 stars 70 forks source link

Unexpected cookies being created on page reload #18

Closed priteshkadiwala closed 6 years ago

priteshkadiwala commented 6 years ago

Firstly, thanks alot with the vue-cookies!! Its great and is really helpful. On the other hand, I am new to cookies and might not have the best understanding on how to go about this problem so I had to post it here.

To give a background, I am using vue-cookies npm to store JWT tokens to see whether the user is authenticated on reloading a page.

I will take you step by step to help you best understand the problem I am facing:

  1. When the user logs in for the first time, I use window.$cookies.set('user_token', resp.data.token, INFINITY) and resp.data.token is the JWT token I receive after making an axios call to the backend. The image below shows that there is one cookie set named user_token. Note: The user is directed to http://localhost:3000/
screen shot 2018-08-29 at 10 28 56 pm
  1. I reload the page and it still successfully logs the user in and shows the results shown in the image above.

  2. Now then I go to another route http://localhost:3000/user/1 which is a reusable route meaning that only the id changes while I call /user/:id to change the route. The pic below shows that it successfully lets the user access the page as the cookie set in the window is still active and matches the one in the backend

screen shot 2018-08-29 at 10 33 43 pm
  1. Now this is where my problem starts where when I reload this route http://localhost:3000/user/1 my cookie in the window changes and there are multiple cookies under the same name and this logs the user out. The pic below shows the difference in the cookie JWT values and there are multiple cookies under the same name. screen shot 2018-08-29 at 10 36 57 pm

Note: I only set cookie when the user logs in and not during reload because the cookie is already set. So I have no idea how the new cookie is being set with a different JWT token of its own. Would it be a bug?