medusa icon indicating copy to clipboard operation
medusa copied to clipboard

feat: add cookie options

Open riqwan opened this issue 5 months ago • 13 comments

riqwan avatar Jun 12 '25 13:06 riqwan

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
api-reference 🔄 Building (Inspect) Visit Preview 💬 Add feedback Jun 25, 2025 8:55am
medusa-dashboard 🛑 Canceled (Inspect) Jun 25, 2025 8:55am
7 Skipped Deployments
Name Status Preview Comments Updated (UTC)
api-reference-v2 ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
cloud-docs ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
docs-ui ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
docs-v2 ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
medusa-docs ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
resources-docs ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am
user-guide ⬜️ Ignored (Inspect) Visit Preview Jun 25, 2025 8:55am

vercel[bot] avatar Jun 12 '25 13:06 vercel[bot]

🦋 Changeset detected

Latest commit: 38ad12d96125598b7ad0ff671db5e434f97e638c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 69 packages
Name Type
@medusajs/framework Patch
@medusajs/types Patch
@medusajs/medusa Patch
@medusajs/test-utils Patch
@medusajs/analytics Patch
@medusajs/api-key Patch
@medusajs/auth Patch
@medusajs/cache-inmemory Patch
@medusajs/cache-redis Patch
@medusajs/cart Patch
@medusajs/currency Patch
@medusajs/customer Patch
@medusajs/event-bus-local Patch
@medusajs/event-bus-redis Patch
@medusajs/file Patch
@medusajs/fulfillment Patch
@medusajs/index Patch
@medusajs/inventory Patch
@medusajs/link-modules Patch
@medusajs/locking Patch
@medusajs/notification Patch
@medusajs/order Patch
@medusajs/payment Patch
@medusajs/pricing Patch
@medusajs/product Patch
@medusajs/promotion Patch
@medusajs/region Patch
@medusajs/sales-channel Patch
@medusajs/stock-location Patch
@medusajs/store Patch
@medusajs/tax Patch
@medusajs/user Patch
@medusajs/workflow-engine-inmemory Patch
@medusajs/workflow-engine-redis Patch
@medusajs/analytics-local Patch
@medusajs/analytics-posthog Patch
@medusajs/auth-emailpass Patch
@medusajs/auth-github Patch
@medusajs/auth-google Patch
@medusajs/file-local Patch
@medusajs/file-s3 Patch
@medusajs/fulfillment-manual Patch
@medusajs/locking-postgres Patch
@medusajs/locking-redis Patch
@medusajs/notification-local Patch
@medusajs/notification-sendgrid Patch
@medusajs/payment-stripe Patch
@medusajs/core-flows Patch
@medusajs/js-sdk Patch
@medusajs/modules-sdk Patch
@medusajs/orchestration Patch
@medusajs/utils Patch
@medusajs/workflows-sdk Patch
@medusajs/medusa-oas-cli Patch
@medusajs/admin-bundler Patch
@medusajs/dashboard Patch
integration-tests-http Patch
@medusajs/cli Patch
@medusajs/oas-github-ci Patch
@medusajs/telemetry Patch
@medusajs/admin-sdk Patch
@medusajs/admin-shared Patch
@medusajs/admin-vite-plugin Patch
@medusajs/icons Patch
@medusajs/toolbox Patch
@medusajs/ui-preset Patch
create-medusa-app Patch
medusa-dev-cli Patch
@medusajs/ui Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

changeset-bot[bot] avatar Jun 12 '25 13:06 changeset-bot[bot]

/snapshot-this

riqwan avatar Jun 12 '25 13:06 riqwan

/snapshot-this

riqwan avatar Jun 12 '25 14:06 riqwan

/snapshot-this

riqwan avatar Jun 12 '25 14:06 riqwan

:rocket: A snapshot release has been made for this PR

Test the snapshots by updating your package.json with the newly published versions:

yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]

Latest commit: d4b093207a989a6a8facbd367c2bd5ddc91cd789

github-actions[bot] avatar Jun 12 '25 14:06 github-actions[bot]

/snapshot-this

thetutlage avatar Jun 18 '25 07:06 thetutlage

:rocket: A snapshot release has been made for this PR

Test the snapshots by updating your package.json with the newly published versions:

yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]

Latest commit: 9bdd5429af3210ebb83edf681be67557de8aa532

github-actions[bot] avatar Jun 18 '25 07:06 github-actions[bot]

/snapshot-this

sgirones avatar Jun 20 '25 05:06 sgirones

:rocket: A snapshot release has been made for this PR

Test the snapshots by updating your package.json with the newly published versions:

yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]

Latest commit: 1c987540aaab4a259042a039719432b4bd0dda2a

github-actions[bot] avatar Jun 20 '25 06:06 github-actions[bot]

/snapshot-this

sgirones avatar Jun 20 '25 06:06 sgirones

/snapshot-this

sgirones avatar Jun 20 '25 06:06 sgirones

:rocket: A snapshot release has been made for this PR

Test the snapshots by updating your package.json with the newly published versions:

yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add [email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]
yarn add @medusajs/[email protected]

Latest commit: 1c987540aaab4a259042a039719432b4bd0dda2a

github-actions[bot] avatar Jun 20 '25 06:06 github-actions[bot]

@olivermrbl could you have a look at this one as well please? We are relying on it on our side through the snapshot for now

adrien2p avatar Jun 25 '25 08:06 adrien2p

Fine to merge if you have reviewed it 💪

olivermrbl avatar Jun 25 '25 09:06 olivermrbl

I tried with cookie configuration

cookieOptions: { sameSite: "none" }

When I login on admin panel both the apis email and session are working fine but "me" (3rd api when login) api is giving unauthorized. When I removed the "cookieOptions" from "projectConfig" it is working fine.

The problem is I want to run api server on different domain and admin panel on different domain, for this I need to set Set-Cookie "SameSite=none" but I am unable to do this.

atinfosec avatar Jul 04 '25 10:07 atinfosec

I tried with cookie configuration

cookieOptions: { sameSite: "none" }

When I login on admin panel both the apis email and session are working fine but "me" (3rd api when login) api is giving unauthorized. When I removed the "cookieOptions" from "projectConfig" it is working fine.

The problem is I want to run api server on different domain and admin panel on different domain, for this I need to set Set-Cookie "SameSite=none" but I am unable to do this.

Hi @atinfosec, this is the default behavior when deployed to staging or production.

if (isProduction || isStaging) {
  secure = true
  sameSite = "none"
}

carlos-r-l-rodrigues avatar Jul 04 '25 14:07 carlos-r-l-rodrigues

I tried with cookie configuration cookieOptions: { sameSite: "none" } When I login on admin panel both the apis email and session are working fine but "me" (3rd api when login) api is giving unauthorized. When I removed the "cookieOptions" from "projectConfig" it is working fine. The problem is I want to run api server on different domain and admin panel on different domain, for this I need to set Set-Cookie "SameSite=none" but I am unable to do this.

Hi @atinfosec, this is the default behavior when deployed to staging or production.

if (isProduction || isStaging) {
  secure = true
  sameSite = "none"
}

Even after creating build using command npx medusa build --admin-only in production mode same issue persist. SameSite in Set-cookie is set to 'Lax' which is default.

atinfosec avatar Jul 04 '25 14:07 atinfosec