Unable to access XSRF cookie from chrome plugin about auth HOT 7 CLOSED

I reproduced the issue in chrome-extension using the Auth package (with local provider). Yes, extension not save cookies in extension context, but you can try get it use chrome.cookies API.
For example:

 chrome.cookies.get({ "url": "https://127.0.0.1", "name": "XSRF-TOKEN" }, function (cookie) {
    console.log(cookie);
 });

 chrome.cookies.get({ "url": "https://127.0.0.1", "name": "JWT" }, function (cookie) {
    console.log(cookie);
 });

And you get results in JSON:

domain: "127.0.0.1"
expirationDate: 1595440998.066463,
hostOnly: true
httpOnly: false
name: "XSRF-TOKEN"
path: "/"
sameSite: "unspecified"
secure: false
session: false
storeId: "0"
value: "0f0289c3849274e48f98efb61f237006ef76ff01",


domain: "127.0.0.1"
expirationDate: 1595440998.06642
hostOnly: true
httpOnly: true
name: "JWT"
path: "/"
sameSite: "unspecified"
secure: false
session: false
storeId: "0"
value: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTUzNTQ4OTgsI..."

Notice that you must set appropriate permission in manifest file for access to cookies api:

 "permissions": [
    ...
    ...
    "http://*/*",
    "https://*/*",
    "cookies"
  ],

from auth.

Or is their any way to circumvent this for development and able to get cookies and keep Auth enabled?

This is what basic auth for. You can allow basic auth for your local development. Another thing you can try (in dev environment) is to disable XSRF check.

from auth.

Confused a little bit. I'm not sure how exactly the chrome extension reports the domain and work with cookies, but why this issue limited for XSRF-TOKEN only? It also should affect JWT cookie exactly the same way. If so, disabling XSRF-TOKEN cookie verification won't help much.

Generally speaking, the idea of disabling XSRF-TOKEN will open a door for CSRF attack. Back in days, the first consumer of this library had several CSRF issues, like this one. I'm not sure how relevant those issues for your case, but to me, the idea of disabling XSRF-TOKEN sounds dangerous.

from auth.

Yeah you are right, I don't want to disable CSRF protection as I have webapp for same. I need a way to somehow send XSRF token to my chrome plugin.

Do you have any option to populate XSRF TOKEN in header instead of cookie?

from auth.

Are you sure XSRF-TOKEN is the only problem? You can disable it with an existing DisableXSRF parameter to check if it "solves" the problem. I think you will still have a similar issue with JWT token

from auth.

@zebox Thanks for quick verification. I did try your method and it seems to work perfectly. 👍

I have one last question, maybe we can close this issue afterwards.
Let's say I have deployed my Go webserver at api.domain.com. Normally we will deploy fronted under same domain and everything works just fine.
But if we want to let's say test our fronted from local dev pc, but with remote backend. Obviously it won't work now as browser won't allow localhost website to access the cookies from api.domain.com. In this scenario, we need to disable Auth/XSRF for development, right? Or is their any way to circumvent this for development and able to get cookies and keep Auth enabled?

from auth.

Got it. Thanks

from auth.