adonis-session not saved on redirect

[TheoA816]

I am using google oauth and auth web guard for my login. Below is the end of my login function, after checking the google login.

await auth.use('web').login(user);
return response.redirect(${Env.get('FRONTEND_DOMAIN')});

In localhost everything works fine, auth user gets initialised and on subsequent route calls the user is still logged in. However after deploying (using render.com), I find auth.user is intialised is saved before the return above. But after redirecting to the frontend, subsequent backend calls show that auth is not initialised. I changed nothing besides the localhost -> production links

The biggest difference I see is in localhost, the adonis-session cookie is passed along with the request

but not in production

i've tried changing config/session.ts (sameSite: false, explicit domain name etc) but nothing works

  cookie: {
    domain: '.onrender.com',
    path: '/',
    httpOnly: true,
    secure: true,
    sameSite: 'none',
  },

I assume the problem has to do with some cookie and domain name related issue but I'm clueless and have gone a whole day on this with no avail. Any help is appreciated

Just for some extra info my login flow is

• user calls /login - gets google redirect url
• from the frontend navigates to url
• log in with google
• /google-callback (i changed the route from google/callback in the config) checks for errors
• log in with web guard as above
• redirects to fe home page

and my google config is as

const allyConfig: AllyConfig = {
	/*
	|--------------------------------------------------------------------------
	| Google driver
	|--------------------------------------------------------------------------
	*/
	google: {
		driver: 'google',
		clientId: Env.get('GOOGLE_CLIENT_ID'),
		clientSecret: Env.get('GOOGLE_CLIENT_SECRET'),
		callbackUrl: `${BACKEND_DOMAIN}/google-callback`,
	},
}

[RomainLanz]

Hey @TheoA816! 👋🏻

Cookies are not cross-domain.
Your frontend and backend must be on the same (sub-)domain to work.

Also, you must use SameSite with LAX.

And lastly, I am not sure about the onrender.com cookie policy, but maybe you will have more chances with a custom domain.

[TheoA816]

Had to do with my FE and BE not being on the same domain. Accessed the backend through a proxy and everything worked fine. Thanks for the comment!