How to add auth session with a spa?

[Disbot-lab]

I'd like to understand how to authenticate a person with a spa. When the user accesses /me he is not authenticated whereas when the login method he is well authenticated

My AuthController:

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import User from 'App/Models/User'
import UserRepository from 'App/Repositories/UserRepository'
import DiscordService from 'App/Services/DiscordService'

export default class AuthController
{
  /**
   * @type {DiscordService}
   */
  public discordService: DiscordService = new DiscordService()
  public userRepository: UserRepository = new UserRepository()

  /**
   * @param {RequestContract} request
   * @param {ResponseContract} response
   * @param {AuthContract} auth
   * @returns {Promise<void>}
   */
  public async login({ request, response, auth }: HttpContextContract)
  {
    try {
      const tokens = await this.discordService.getTokens(request.input('code'))
      const user = await this.userRepository.findByAccessToken(tokens.access_token)
      const fetchUser: User = user ? user : await this.discordService.getUser(tokens)
      await fetchUser.save()
      // auth works
      await auth.login(fetchUser)
      response.json({fetchUser})
    } catch (e) {
      console.log(e)
      response.abort('Code invalide', 400)
    }
  }

  public async me({response, auth}: HttpContextContract)
  {
    // auth does not work
    await response.json(auth)
  }
}

I can't find a cookie in my spa, so I guess that's not normal.

[thetutlage]

Are you using the auth middleware on the /me route? https://preview.adonisjs.com/guides/auth/middleware#auth-middleware

[thetutlage]

In that case.

• Is your backend server and the frontend app on the same domain? Cookies are not shared cross domain
• Make sure the withCredentials property is set. If you are using axios, then here's a guide on same https://flaviocopes.com/axios-credentials/

[Disbot-lab]

my api is in a sub-domain, I thought sub-domains worked with cookies. Is there a way to do it with a subdomain? Because my api is on a different server.

[Disbot-lab]

I don't use credentials, everything is retrieved via oauth, do I need to put it on anyway?

[thetutlage]

You need to read about how cookies work with ajax requests and you will get the answer

[Disbot-lab]

I just replaced this

axios.create({
  withCredentials: true
})

with this

axios.defaults.withCredentials = true

I just misconfigured it, now it's working.