hasura / hasura/graphql-engine

Missing 'Authorization' or 'Cookie' header in JWT authentication mode with Cookie Enabled

Open
#9,820 4 comments 0 reactions 0 assignees View on GitHub
c/console k/bug t/console
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version:
CLI Version (for CLI related issue): hasura/graphql-engine:v2.29.1

### Environment
Hasura Docker

### What is the current behaviour?

When I enable the Hasura JWT Authentication with header type cookie It's working fine when hit through my application endpoint. But, when I try to add the Cookie in the Hasura console it's not considering the Cookie which I added in the Hasura console header. and throws the error `Missing 'Authorization' or 'Cookie' header in JWT authentication mode`.

### What is the expected behaviour?
Cookies also should be included when making a request from the Hasura console when I add it to the header.

### How to reproduce the issue?

1. In the Hasura docker-compose enable JWT mode with following environment variable.
`HASURA_GRAPHQL_JWT_SECRET: '{"type":"RS256","jwk_url":"https://cognito-idp.${REGION}.amazonaws.com/${COGNITO_ID}/.well-known/jwks.json","claims_format":"stringified_json","header":{"type":"Cookie","name":"token"}}'`
2.
3.
4.

### Screenshots or Screencast
![Hasura-console](https://github.com/hasura/graphql-engine/assets/52650773/a916d8e7-f59f-4487-8d9a-120db41ad697)

![no-cookie-request-header](https://github.com/hasura/graphql-engine/assets/52650773/e3d34628-029c-43a4-b59e-4e0a3822dab6)

### Please provide any traces or logs that could help here.

### Any possible solutions/workarounds you're aware of?

As of now, I don't have any workaround for this.

### Keywords

Hasura Header, Cookie, JWT token

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the request in the Hasura console using the Docker configuration and JWT secret shown in the issue. Trace how console headers are applied to the request, then verify that the configured Cookie header is sent and the JWT request no longer fails with the missing-header error.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.