haskell-servant / haskell-servant/servant

Route selection for endpoints protected by Cookie Auth

Open
#1,524 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
2k
Forks
427
Avg merge
2d 23h
Merged PRs (30d)
5

Description

Hello, I'm having an issue with the behavior of the router that I don't know how to resolve. I have the following Server definition:

```haskell
type HomeRoute = HXRequest :> Get '[HTML] (Partial Home)

type UnprotectedRoutes = HomeRoute

type ProtectedRoutes = HomeRoute

type Routes =
(Auth '[Cookie] Model.User :> ProtectedRoutes)
:<|> UnprotectedRoutes

```
As you can see, I have a `HomeRoute` under both `UnprotectedRoutes` and `ProtectedRoutes`. It returns a different home page depending on whether or not the user is logged in. The issue is that the routing mechanism doesn't seem to differentiate between

```haskell
Auth '[Cookie] Model.User :> HXRequest :> Get '[HTML] (Partial Home)
```
and

```haskell
HXRequest :> Get '[HTML] (Partial Home)
```
In my opinion, the way this should work is like this:

1. If the request from the client has the cookie, match against the first route.
2. If the request doesn't have a cookie, then match against the second route.

But it doesn't work like that. It matches against `HXRequest :> Get '[HTML] (Partial Home)` whether or not the request has a cookie.

This means I can't represent two pages, one for a non-authenticated users and one for an authenticated users, by the same URL. I want to be able to get to both routes with the same URL `baseUrl/`. Instead, I must add a path in front of the protected route, like `baseUrl/protected/`.

This works fine:

```haskell
Auth '[Cookie] Model.User :> "protected" :> HXRequest :> Get '[HTML] (Partial Home)
```
Is there a way around this? Maybe my Server types aren't structured correctly? If it's not possible I don't want to waste more time on the problem. It's just a slight annoyance.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the route definitions shown in the issue, comparing the protected and unprotected HomeRoute at the same URL with and without a Cookie. Read the Servant Auth '[Cookie] combinator and route-selection behavior first. Done means determining whether both routes can be selected by cookie presence, or documenting why a distinct path is required.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.