Set-Cookie not respected in redirects

[waltonseymour]

Currently requests made from fab runtime to endpoints which set a cookie and redirect (https://httpbin.org/cookies/set?freeform=test for example) do not set cookies.

I would expect this to have the same behavior as cloudflare workers which does in fact set the cookies from the redirect.

reference code:

  const forwarded_request = new Request(request);
  forwarded_request.headers.set("host", "httpbin.org");
  return new Request(
   `https://httpbin.org${url.pathname}${url.search}`,
    forwarded_request
  );

[geelen]

Hmm, what would be the equivalent Workers code here? You'd have to actually be calling fetch on the new Request object to fire the subrequest, right?

[waltonseymour]

very similar code for cloudflare workers:

addEventListener("fetch", event => {
  try {
    event.respondWith(handleEvent(event));
  } catch (e) {
    event.respondWith(new Response("Internal Error", { status: 500 }));
  }
});

async function handleEvent(event) {
   const url = new URL(event.request.url);
   const forwardedRequest = new Request(event.request);
   forwardedRequest.headers.set("host", "httpbin.org");
   return fetch(new Request(`https://httpbin.org${url.pathname}${url.search}`, forwardedRequest));
}

deployed here: https://mute-queen-572f.vanta-preview.workers.dev/cookies and can be tested via https://mute-queen-572f.vanta-preview.workers.dev/cookies/set?freeform=testing123

[geelen]

I think if you port that logic more directly to the FAB it should work:

  const forwarded_request = new Request(request);
  forwarded_request.headers.set("host", "httpbin.org");
  return fetch(new Request(
   `https://httpbin.org${url.pathname}${url.search}`,
    forwarded_request
  ));

Note the addition of fetch. The whole pattern of returning a Request object was something that was mainly useful on AWS Lambda, so on Cloudflare I'd recommend always returning Responses

[weberjm]

@geelen Quick question on this: is this documented anywhere? I asked a question about the Cloudflare behavior back in June on Discord, with no response. Is this something that was supposed to already be known?