CODEWITHSUNDEEP
herokucookiescross-domainsamesite
InfinityVive
InfinityVive

Reputation: 176

How can I share cookies between two subdomains of herokuapp.com?

I am currently trying to host a website as an experiment on Heroku, I deployed the back end which you can consider yyyy.herokuapp.com and the front end with you can consider xxxx.herokuapp.com,

Now, here's the issue, I need to set cookies between xxxx and yyyy, I know this will be a massive security issue but since this is an experimental website I am not willing to get a custom domain, I tried to set the cookies' domain to: herokuapp.com, .herokuapp.com, *.herokuapp.com, xxxx.herokuapp.com, yyyy.herokuapp.com.

Yet it doesn't work, chrome denies the cookies and gives this message:

This attempt to set a cookie via a Set-Cookie header was blocked because its Domain attribute was invalid with regards to the current host url.

So, how do I approach this issue without the need for a custom domain? this is my configuration to set cookies (on the back end which uses flask)

response.set_cookie("example_cookie", value="cookie value", 
    max_age=900, expires=datetime.datetime.utcnow() + 
    datetime.timedelta(seconds=900), secure=True, domain=".herokuapp.com", 
    samesite='none')

Upvotes: 3

Views: 1590

Answers (1)

jub0bs
jub0bs

Reputation: 66244

If herokuapp.com were not a public suffix (a.k.a. an effective top-level domain or eTLD), then in the case of a cookie set by xxxx.herokuapp.com with Domain=herokuapp.com, browsers would send that cookie to yyyy.herokuapp.com

However, there is a snag: in order to isolate its different tenants, Heroku required herokuapp.com be added to the public-suffix list a while back. Most browsers refuse to set a cookie for a public suffix:

For security reasons, many user agents are configured to reject Domain attributes that correspond to “public suffixes”. For example, some user agents will reject Domain attributes of “com” or “co.uk”.

Therefore, attempts to set a cookie with Domain=herokuapp.com will be rejected by browsers, as you've experienced.

Note: adding a leading dot in the Domain attribute of the Set-Cookie HTTP header has no effect, at least in modern browsers.

To get out of this difficulty, you could simply buy a cheap domain name (say infinityvive.com) to serve both your frontend and backend from subdomains of it. Then you'd be able to use Domain=infinityvive.com because your domain would not be a public suffix.

Upvotes: 5

Related Questions