pouchdb: PouchDB 7.0.0 breaks cookie authentication

Issue

After upgrading to PouchDB 7.0.0 from 6.4.3, authentication using pouchdb-authentication stops working.

The call to the _session endpoint is successful ({ ok: true, ... }) but there’s no Set-Cookie header on the response from the CouchDB server.

Even though the release notes say that we switched to fetch, the call to _session is being made via XHR. Could this mean it’s a pouchdb-authentication issue?

Info

  • Environment: Browser
  • Platform: Chrome, Firefox, iOS UIWebView, i assume any others
  • Adapter: IndexedDB
  • Server: CouchDB 2.1.1

About this issue

  • Original URL
  • State: closed
  • Created 6 years ago
  • Comments: 16 (6 by maintainers)

Most upvoted comments

What a shame to mantainers( When auth is core functionality…

After way too much time struggling with this in an electron app, I finally discovered you can also get this to work by providing the auth option with credentials:

    const remoteDb = new PouchDB(url, {
      skip_setup: true,
      auth: { username, password }
    });

This will use basic auth, but it no longer requires https://github.com/pouchdb-community/pouchdb-authentication

My problem might be more relevant to using pouchdb on a node server. The browser will handle any set-cookie for you and will send them back with future requests (if you set the options.credentials = ‘include’). You can also fix the missing credentials by giving the pouchdb constructor a custom fetch where you set the option like this:

      let db = new PouchDB(remote_couch, {
        fetch: function (url, opts) {
          opts.credentials = 'include';
          return PouchDB.fetch(url, opts);
        }
      });

This might be more user friendly than having to hack in node_modules files.

But when you are using pouchdb on node, it itself has to take care of the cookie store. This is done by using fetch-cookie, which sets the cookie headers for you. But due to a bug in 0.7.0 there this won’t work if the initial request already has headers set, which pouchdb requests have. So if pouchdb could update to fetch-cookie@0.7.2 nodejs would be fixed. But I guess I might have been hijacking this topic. I will make a separate issue or PR for this.

@daleharvey actually your pull request fixes the issue, the underlying problem was that pre-7 versions of PouchDB would send cookies with every request by default, whereas 7.0.0 doesn’t any more. Until your PR is rolled out we applied the change after bundling (via our build script) and it works perfectly. Thanks!