Impossible to retrieve AuthSession cookie Couchdb via javascript

1
votes

I'm trying to setup a login/logout page via javascript for a single page application (pouchdb).

retrieving and sending authsession cookie via curl works fine as described in the documentation, however when I try to reproduce it in javascript, var contType = AjaxRequest.getAllResponseHeaders(); alert(contType);

the only parameters I can retrieve are:

Server: CouchDB/1.5.0 (Erlang OTP/R16B01) Content-Type: text/plain; charset=utf-8 Cache-Control: must-revalidate

Anyone succeeded to retrieve this session cookie and use it with javascript ? thanks, jl

2
securitycouchdbpouchdb
I've been having the same problem. I actually see the cookie in the request, but there are some odd things happening that I can't really explain with great detail involving CORS and cookies. Apparently the set-cookie is ignored in my case as I am using localhost as my domain... There is something about that and the cors that eliminates the cookie in javascript. My app is an angular/cordova app. - TyMayn

2 Answers

2
votes

The AuthSession is marked as HTTPOnly - i.e. it will only be exposed over HTTP(S) and is not available to JavaScript (to prevent tampering).

A call to /_session will return a 200 response if the user authenticated correctly or a 401 if the credentials are incorrect. In the event of success (200 response), the AuthSession cookie will be automatically stored by the browser and passed to future requests to the CouchDB url until either the browser/tab is closed or you make a DELETE request to /_session.

You should be able to implement a login page given those semantics without needing to access the cookie directly.

0
votes

That's a good question. I don't know if I can answer that but I have a different way of going about it. The browser itself should have the cookie set once the ajax request is made.

https://github.com/carhartl/jquery-cookie

I've had a positive experience using this jQuery plugin to handle the AuthSession cookie from CouchDB logins. $.cookie("AuthSession") usually does the trick.