I have the following cookie set during a login call (https://localhost.company.com:4430/login):
Name=COMPANY.AUTH
Value=<an encoded value>
Domain=.company.com
Path=/
Expires=<well in the future>
HttpOnly=true
Secure=false
SameSite=Lax
SameParty=<not set>
Priority=Medium
When I instigate an HTTP request to https://api-localhost.company.com/some-api in either Chrome 90 or Firefox 88, the cookie is not attached.
I cannot understand why. Moreover, Chrome does not show the Cookies tab against the request, which is supposedly able to help diagnose why cookies are not being attached.
Can anyone tell me why the above wouldn't work?
Related
I encountered a web form today which works for Firefox but not chromium (tested Edge and Chrome).
The form action leads to a HTTP 302, after that another 302, and then finally 200 - at least with Firefox and Fiddler and Rested (brower addon). However, when trying with chromium it's just plain 404 Not found. I double checked all headers and parameters, it's the same for both.
I tried to document what I saw.
https://i.stack.imgur.com/Ux6B1.jpg - working in Rested
https://i.stack.imgur.com/YoBnv.jpg - whatever chromium is doing
Do I have to call the people responsible for the form or is there any browser setting I am not aware of?
I have https on my page but Chrome says it is not secure. I dont understand what is wrong. Look at the screenshot.
You are loading an image over HTTP and so the content is mixed causing the warning.
The image in question is dark-grey-tile.png it's coming from http://plugins.jquery.com/jquery-wp-content/themes/jquery/images/dark-grey-tile.png note the http here - not https
In Chrome I like to look at the result headers and see relevant debugging http requests. Chrome doesn't let you see that if the result was a 400 or 500 error because instead it redirects you to a "This page isn’t working" page that they have baked in.
Is there anything in Chrome that allows us to disable this behavior so we can see the actual result with it's headers?
I am trying to make a CORS request with credentials(Cookies attached) and Chrome is not attaching the Cookie to my request. I have set the cookie to a sub-domain of the existing page and i could observe it is set successfully from the Cookie manager.
I do not have this problem with Chrome 78th version(latest version). But for the previous versions, I have this problem(I have checked 75 and 77). As well as i do not have any problem with other major browsers also. They also attach cookies without a problem.(I have tested my code with Firefox, IE, Opera and Edge)
This how I have set the Cookie from external service end.
res.setHeader('Set-Cookie','cdn-token=exp3header_same-site-none; domain=.local.com; path=/; SameSite=None;');
Complete sample code base can be found in following links:
External service - https://github.com/bhanukayapa/cors-backend.git
Front-end application - https://github.com/bhanukayapa/cors-angular-frontend.git
Can someone please explain the root cause for this problem? I checked Chrome release notes also. I could not find and bug fix or improvement related to this. Thanks in advance.
If setting SameSite=None this must be paired with Secure. e.g.
res.setHeader('Set-Cookie','cdn-token=exp3header_same-site-none; domain=.local.com; path=/; SameSite=None; Secure');
I am doing fragmented mp4 live streaming over http for a html5 video tag and so far it is happily working with Chrome, however FF and IE seem to be failing. VLC and ffplay also play the stream fine. I tried to look into more details that could make FF unhappy and eventually found that I was using the wrong HTTP respone code - I was sending 200 OK instead of 206 Partial Content. I'm still not sure if this is what's upsetting FF and IE but after reading through the RFC's and everything I came to a conclusion that I do not know how to specify a response header for the request header Range: bytes=0-. I have a live stream and I do not know the length so that should be set as * but if I reply with Content-Range: bytes 0- /* even Chrome immediately closes the connection, so I guess it is wrong. So what is the correct respone header?
Or should I just ignore the request header and give back a 200 OK?