pouchdb: PouchDB 7.0.0 breaks cookie authentication
Issue
After upgrading to PouchDB 7.0.0 from 6.4.3, authentication using pouchdb-authentication
stops working.
The call to the _session
endpoint is successful ({ ok: true, ... }
) but there’s no Set-Cookie
header on the response from the CouchDB server.
Even though the release notes say that we switched to fetch
, the call to _session
is being made via XHR
. Could this mean it’s a pouchdb-authentication
issue?
Info
- Environment: Browser
- Platform: Chrome, Firefox, iOS UIWebView, i assume any others
- Adapter: IndexedDB
- Server: CouchDB 2.1.1
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 16 (6 by maintainers)
What a shame to mantainers( When auth is core functionality…
After way too much time struggling with this in an electron app, I finally discovered you can also get this to work by providing the
auth
option with credentials:This will use basic auth, but it no longer requires https://github.com/pouchdb-community/pouchdb-authentication
My problem might be more relevant to using pouchdb on a node server. The browser will handle any set-cookie for you and will send them back with future requests (if you set the options.credentials = ‘include’). You can also fix the missing credentials by giving the pouchdb constructor a custom fetch where you set the option like this:
This might be more user friendly than having to hack in node_modules files.
But when you are using pouchdb on node, it itself has to take care of the cookie store. This is done by using fetch-cookie, which sets the cookie headers for you. But due to a bug in 0.7.0 there this won’t work if the initial request already has headers set, which pouchdb requests have. So if pouchdb could update to fetch-cookie@0.7.2 nodejs would be fixed. But I guess I might have been hijacking this topic. I will make a separate issue or PR for this.
@daleharvey actually your pull request fixes the issue, the underlying problem was that pre-7 versions of PouchDB would send cookies with every request by default, whereas 7.0.0 doesn’t any more. Until your PR is rolled out we applied the change after bundling (via our build script) and it works perfectly. Thanks!