🐛Why setup session config with Cookie secure and HttpOnly=true then can not get cookie value in context?

[phuongdpham]

Fiber version
v2.17.0

Issue description
When I set up session store config with CookieSecure=true and HttpOnly=true, then I can't get session from context, it create new id because of not found cookie session_id value. (id := c.Cookies(s.sessionName)). For Key lookup default in Cookie.

Code snippet
store.go line 92...

// getSessionID will return the session id from:
// 1. cookie
// 2. http headers
// 3. query string
func (s *Store) getSessionID(c *fiber.Ctx) string {
	id := c.Cookies(s.sessionName)  // return nil while I pass session_id in cookies
	if len(id) > 0 {
		return id
	}

	if s.source == SourceHeader {
		id = string(c.Request().Header.Peek(s.sessionName))
		if len(id) > 0 {
			return id
		}
	}

	if s.source == SourceURLQuery {
		id = c.Query(s.sessionName)
		if len(id) > 0 {
			return id
		}
	}

	return ""
}

Please figure out how to retrieve cookie value if it's not a bug issue. Thanks.

[welcome]

Thanks for opening your first issue here! 🎉 Be sure to follow the issue template! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

[ReneWerner87]

can not understand this unfortunately, here is my example code

package main

import (
    "fmt"
    "log"
    "time"

    "github.com/gofiber/fiber/v2"
    "github.com/gofiber/fiber/v2/middleware/session"
)

func main() {
    app := fiber.New()
    store := session.New(session.Config{
        CookieSecure: true,
        CookieHTTPOnly: true,
    })

    app.Get("/sessionId", func(ctx *fiber.Ctx) error {
        sess, err := store.Get(ctx)
        defer sess.Save()
        if err != nil {
            return err
        }

        fmt.Println(time.Now().Format("15:04:05.000000"), sess.ID())
        return ctx.SendString(sess.ID())
    })


    log.Fatalln(app.Listen(":3000"))
}

Output:

please also check if you are running the sess.Save(), otherwise it will create a new session for every request, because there is none in the storage.

[phuongdpham]

Hi ReneWerner87,

Thank you for your reply. When I run your sample code, this is my response

I call from postman or curl from terminal sessionId also different. That's so stranger

[ReneWerner87]

this is expected behavior and not a bit strange

the session concept only works if the client requesting the server also sends the session id sent in the response in the request the next time so that the server can use it to retrieve the data from the persistence layer and assign it to the client

if you use curl or postman, you have to send this id, which is set by default in the cookie in the response, in the next request.

in the browser this works automatically, because the cookies are taken from the response in the browser and are automatically sent with the next request (such concepts where the client has to remember things exists, like with the etag header etc.)

curl and postman are stateless and don't remember anything after the request by default

[phuongdpham]

Ohh, I see the problem. The postman won't auto set cookie in request if that cookie is secure and http only. Thank you for your explain.