Graph/932d52a0-9089-4649-901c-8573794eda66

Domainunvalidated

Cookie Management

932d52a0-9089-4649-901c-8573794eda66

Cookie Management

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0003

Effectiveness0.000

Connections

44 linked nodes

RELATES_TOProblem

Using Fetch from my `index.html` from my `portal.mydomain.com` does not. — Enter `api.mydomain.com` into a browser directly does save my cookie. Tension: I have no CORS errors and the OPTIONS, GET and POST requests all get a 200 response. Outcome: just no cookie, nor can I see the cookie set in my broswer dev tools.

PERTAIN_TOProblem

FastAPI route works locally on / but fails on Vercel

PERTAIN_TOProblem

when I refresh my page the cookie gets deleted — I have deployed my sveltekit frontend and python flask backend on vercel. Tension: On localhost, they worked just fine however when I deployed it, the cookies were not persistent. Outcome: it does sets the cookie, but on refresh, the cookie gets disappeared.

PERTAIN_TOSolution

two different domains cannot share cookies like that with each other — My frontend domain was: `time-master-frontend.vercel.app` My Backend domain was: `time-master-backend.vercel.app`. Tension: because they both are of different domains? Outcome: they need to be a subdomain or be one the same domain.

PERTAIN_TORootCause

I was getting the cookies in fetchwrapper for auth token — during build. Tension: reason being. Outcome: I passed the auth token from the component instead of getting it in fetchwrapper.

PERTAIN_TOSolution

Clear the cookies and test it — on another browser. Tension: private routes all redirect to the home page. Outcome: it went trough just fine.

PERTAIN_TOProblem

it is failing to get the toekns/cookies — I am using Python `requests` to make a request to the API from my `streamlit` app. Outcome: return "Failed to fetch access token and refresh token".

PERTAIN_TOSolution

use `Session` objects from Python `requests` library — in order to persist cookies across requests. Outcome: s = requests.Session().

PERTAIN_TOProblem

Using Fetch from my `index.html` from my `portal.mydomain.com` does not. — Enter `api.mydomain.com` into a browser directly does save my cookie. Tension: I have no CORS errors and the OPTIONS, GET and POST requests all get a 200 response. Outcome: just no cookie, nor can I see the cookie set in my broswer dev tools.

PERTAIN_TOProblem

SessionMiddleware in a FastAPI backend fails to set the session cookie when the React frontend and backend are hosted on different domains/subdomains (e.g., XXX-ui.fly.dev vs XXX-api.fly.dev). The browser rejects the cookie with an 'invalid domain' error and no session is maintained.

PERTAIN_TOSolution

Use a single owned base domain and route UI and API via subdomains (e.g., my-app.com and api.my-app.com), then set the cookie Domain to a parent domain (e.g., `.my-app.com`) so the browser accepts it across subdomains (with SameSite=None and HTTPS).

PERTAIN_TOProblem

Tension: From my research and own implementation I get mixed answers. Outcome: If I restart my app, I still can access the session data using the token.

PERTAIN_TOProblem

$_SESSION['eepasts'] is empty after Stripe payment redirect

PERTAIN_TOSolution

You probably serve the page both on the `www` subdomain and on the naked domain — You should decide whether you want `www` or not. Tension: Otherwise you may eventually run into more issues. Outcome: This will solve your problem and avoid future problems as well.

PERTAIN_TOProblem

it always return undefined or empty string — I want to get the cookie with my client component. Tension: I am using js-cookie since someone recommend it.

PERTAIN_TOSolution

Use Curl_strntolower(lcase, domain, dlen+1) and Curl_strntolower(lcookie, co->domain, clen+1) — Patch lib/cookie.c around lines 1031-1048. Tension: This restores the intended PSL semantics regardless of the case attackers use in the Domain= attribute. Outcome: pass the normalized buffers to PSL.

PERTAIN_TORootCause

The cookie specifies my domain name, HTTPOnly is set to true, secure is true and samesite is lax — integrate it as an iframe within salesforce or any other CRMs. Tension: A Session needs to be maintained for authentication and authorization. Outcome: They can whitelist only /cpq page.

PERTAIN_TOProblem

If at all I login in a new tab and close it. Tension: A Session needs to be maintained for authentication and authorization. Outcome: How can I achieve it?

PERTAIN_TOProblem

Embedding a CPQ web app as an iframe inside Salesforce fails to persist authentication cookies/session for API calls. Login in a new tab isn’t recognized inside the Salesforce iframe, preventing authorized requests.

PERTAIN_TOSolution

Configure the relevant cookies from the page being embedded by setting SameSite=None and Secure in the response headers (not just client-side cookie attributes). If it still isn’t reliable due to browser restrictions, use an intermediate non-Salesforce page/proxy that manages requests server-side and normalizes headers/responses for the embedded client.

PERTAIN_TOSolution

Set-Cookie: Path=/; Domain=.example.com — Cookies coming from app.example.com can be sent to api.example.com. Tension: third-party blocking default policy on browsers nowadays. Outcome: look for the cookie header in the request.

PERTAIN_TOProblem

the cookie will be specifically set with `domain=app.sunsetland.com.au`. Tension: if we were to host another subdomain aside from `app.`, we actually would likely encounter the reCAPTCHA challenge again.

PERTAIN_TOSolution

the implementation of reCAPTCHA Enterprise. Tension: the cookie will be specifically set with `domain=app.sunsetland.com.au`.

PERTAIN_TOProblem

A Rails cookie_store session cookie decrypted from production contains no explicit timestamp fields, so it’s unclear how Rails determines when the session should expire to prevent session replay attacks.

PERTAIN_TOSolution

Inspect the response Set-Cookie header (or the browser’s stored cookie details) to see the Expires date generated from expire_after; alternatively check session.options[:expire_after] to confirm the configured value.

PERTAIN_TOSolution

Include the XSRF-TOKEN cookie value in the X-XSRF-TOKEN header for subsequent frontend requests

PERTAIN_TOProblem

can I create, from 2. and 3. a server side httpOnly cookie (containing a `widget_id`) of domain `mycompany-example.com`, that can be used during step 5. Outcome: when the user visits our website so we know which widget they come from ?

PERTAIN_TOProblem

Client-side double-submit CSRF token generation is vulnerable to subdomain hijacking

PERTAIN_TOSolution

Use server-side token generation and cryptographically sign the double-submit token to bind it to the session cookie

PERTAIN_TOSolution

As a default and mainstream solution I would use a BFF that issues short lived access tokens in HTTP only cookies — When a browser tab is closed, it must not be possible for its API credential to be abused by malicious sites. Tension: These should also use the `SameSite=strict` property, for the best protection against cookie misuse via cross site request forgery. Outcome: These should also use the `SameSite=strict` property.

PERTAIN_TOSolution

Pass a cookie in a custom header — Webview cookies from react native application. Outcome: something like this:.

PERTAIN_TOProblem

What are the pros and cons of high php session.sid_bits_per_character and session.sid_length? — As the title asks,. Tension: longer length means bigger cookies and longer processing, also longer for RDBS id matching. Outcome: Is there any reason NOT to change these 2 settings to the following in the php.ini file?

PERTAIN_TOSolution

A 192-bit sid (32 bytes at six bits per byte) is just fine — session.sid_bits_per_character and session.sid_length. Tension: 256 bytes is overkill. Outcome: You can get away with that once in a great while if you announce scheduled downtime.

PERTAIN_TORootCause

vulnerable.com sets the double submit token in the User's cooki es, and also returns the token as part of the form back to attacker.com — attacker.com sends a GET request through User's browser to get the form from vulnerable.com.

PERTAIN_TOProblem

HTTP request headers are not a good way to track users — In case of HTTP requests like HEAD / GET / POST etc. Tension: the server has no way to verify their authenticy.

PERTAIN_TOSolution

My suggestion is using a cookie with a unique, random id — given to the user the first time they land on a page of your site. Tension: the user can still edit/remove this cookie. Outcome: If you can force the user to login, then you could track the user with their session token.

PERTAIN_TOSolution

Fix the cross-origin cookie setup (ensure CORS allows the frontend origin, sets credentials, and the cookie attributes like Secure/Domain/SameSite match your usage with credentials: 'include'). Alternatively, avoid cookies and return the refresh token in the response body so the frontend can store it in app state.

PERTAIN_TOProblem

The browser does not store the refresh token cookie returned by the Django Ninja login endpoint, even though the cookie appears in the response headers and the fetch call uses credentials: 'include'.

PERTAIN_TOReport

Better Auth getSession() crashes Next.js 15 Server Components with "Cookies can only be modified" error

PERTAIN_TOReport

CVE-2023-46218: curl cookie PSL check missing in Curl_cookie_getlist() — asymmetric validation logic-bug

PERTAIN_TOReport

CVE-2023-46218 curl cookie mixed-case PSL bypass in Curl_cookie_add

PERTAIN_TOProblem

curl will accept and store the super-cookie — In lib/cookie.c, Curl_cookie_add() guards against setting cookies whose Domain attribute is a Public Suffix. Tension: libpsl's matching is case-sensitive against its lowercase PSL data. Outcome: the PSL test never sees the canonical 'co.uk'.

PERTAIN_TOProblem

throws "Cookies can only be modified in a Server Action or Route Handler" — called from Next.js 15 Server Components (pages, layouts). Tension: The error appears intermittently — only when the session needs refreshing (controlled by `updateAge` config). Outcome: With `updateAge: 300` (5 minutes), it crashes every ~5 minutes for active users.

PERTAIN_TOSolution

`query: { disableRefresh: true }`.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info