How to authenticate subscriber? about mercure HOT 3 CLOSED

Hello,

Indeed, you have two solutions for subscriber authorization:

• serve the hub from the same domain (or from a subdomain) of the application server. Then set the cookie from the application server, it will automatically be sent to the hub by the browser. It’s the recommended solution (the most secure)
• Alternatively, if you use different domains, you can use a header, but then you cannot use EventSource. You’ll have to use fetch directly, or an EventSource polyfill supporting headers such as https://github.com/Yaffle/EventSource

from mercure.

Thanks!

I myself prefer the second solution, because having both hub and application server on one domain might induce other issues or might not be easy to setup.

I tried the polyfill, but still no success. For some reason it repeatedly creates OPTIONS request before opening the stream, which is something native EventSource does not, and the server does not send correct CORS headers in response to those OPTIONS requests, therefore the stream never opens. (Also, server responds with 403 to the OPTIONS requests, which is odd, because GET requests work with no problems). Isn't there a bug in the server regarding this behaviour? Or is this intended?

Have you considered adding a URL-based authentication mechanism?

Thanks a lot, I like the work!

from mercure.

@stanleyk thanks for trying! #18 fixes the issue

from mercure.