lexik/LexikJWTAuthenticationBundle

Split cookies are all set in the same string

fhuszti opened this issue · 0 comments

EDIT: after some more testing, it appears it's a problem with Vercel's edge runtime. Not sure anyone can do anything about this on here, but I can't delete this issue

I have my symfony API setup for split cookies from lexikJWT, and I call this backend from a nodejs/edge environment that serves as middleman between the API and the frontend.
When calling the login route from Postman, it parses the response fine, Postman shows me there are three Set-Cookie headers in the response, as it should (split cookies + refresh).
But when I call it from my javascript, I get all three cookies in a single Set-Cookie header, I had to create a specific function with a regex to parse it and separate it in three cookies so I can set them on the client.
Anyone knows why I don't get the three separate Set-Cookie headers on my frontend?

LexikJWT config:

lexik_jwt_authentication:
    secret_key: '%env(resolve:JWT_SECRET_KEY)%'
    public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
    pass_phrase: '%env(JWT_PASSPHRASE)%'
    token_ttl: 1800
    
    token_extractors:
        split_cookie:
            enabled: true
            cookies:
                - jwt_hp
                - jwt_s
                
    set_cookies:
        jwt_hp:
            lifetime: null
            samesite: strict
            path: /
            domain: null
            httpOnly: false
            partitioned: false
            split:
                - header
                - payload
        jwt_s:
            lifetime: 0
            samesite: strict
            path: /
            domain: null
            httpOnly: true
            partitioned: false
            split:
                - signature

Refresh config:

gesdinet_jwt_refresh_token:
    refresh_token_class: App\Infrastructure\Security\Entity\RefreshToken
    ttl_update: true
    return_expiration: true

    cookie:
        enabled: true
        same_site: strict
        path: /
        domain: null
        http_only: true
        secure: true
        remove_token_from_body: true

Javascript side, this is how it looks, just to be complete:

const response: Response = await fetch(process.env.BACKEND_URL+BACKEND_LOGIN, {
	method: 'POST',
    body: JSON.stringify(credentials),
    headers: { "Content-Type": "application/json" }
});

if (response.ok) {
	console.log(response.headers.getSetCookie());
}

This console.log gives me:

['jwt_hp=eyJ0eXAi[...]NvbSJ9; expires=Mon, 08 Jan 2024 08:10:25 GMT; Max-Age=1800; path=/; secure; samesite=strict, jwt_s=FROmh3[...]moK9tsg; path=/; secure; httponly; samesite=strict, refresh_token=75dca[...]5ba97c; expires=Wed, 07 Feb 2024 07:40:25 GMT; Max-Age=2592000; path=/; secure; httponly; samesite=strict']

when I expected the cookies to arrive in three different strings in the array.