faustinoaq changed the topic of #amber to: Welcome to Amber Framework community! | https://amberframework.org | Developer happiness, productivity and bare metal performance | GH: https://github.com/amberframework | Docs: https://docs.amberframework.org | Gitter: https://gitter.im/amberframework/amber | IRC Logger: https://irclog.whitequark.org/amber | Amber::Server.start
_whitelogger has joined #amber
_whitelogger has joined #amber
_whitelogger has joined #amber
<FromGitter> <valamorgon> I have to pipeline one is default "web" and the other is "api"
<FromGitter> <valamorgon> I configured it like this:
<FromGitter> <valamorgon> pipeline :web do ⏎ ⏎ ```code paste, see link``` ⏎ ⏎ end [https://gitter.im/amberframework/amber?at=5cac249b759abc043c8e5615]
<FromGitter> <valamorgon> for my sessions I can read from both sides but for my I can only set them from web
<FromGitter> <valamorgon> when set my session through api (my api shares the cookie with web) I can only read, but I can't set
<FromGitter> <valamorgon> how should I debug this issue?
<FromGitter> <elorest> Sessions are set from the controllers, and then sent to the browser/api with the header `Set-Cookie`. You'll then need to send it back on every request/post with `Cookie`.
<FromGitter> <valamorgon> @elorest I already return cookies in every request, but in the same request I can read the existing session but can't set a new one.
<FromGitter> <valamorgon> for example
<FromGitter> <valamorgon> def test ⏎ p session["web"] ⏎ session["api"] = true ⏎ ⏎ end [https://gitter.im/amberframework/amber?at=5cac269693fb4a7dc2fa9925]
<FromGitter> <valamorgon> for this method session web returns a value, but when I set api to true, I cant see it again in the next request
<FromGitter> <elorest> what is your client?
<FromGitter> <valamorgon> normally android device and browser
<FromGitter> <valamorgon> but now in order to debug I use curl
<FromGitter> <valamorgon> for api
<FromGitter> <valamorgon> curl mywebsite/testapi2 -H "Cookie: mycookie; amber.session=mysession" -H "Origin: mywebsite"
<FromGitter> <valamorgon> I do it like this
<FromGitter> <elorest> What does the return header look like for `Set-Cookie` does it change at all between requests?
<FromGitter> <valamorgon> I follow from amber cli logs, in each request it is always same value for cookie
<FromGitter> <valamorgon> even for web also for api
<FromGitter> <elorest> Hmmm. If you're changing it then it shouldn't be the same. I'm spinning up a test env really fast.
<FromGitter> <valamorgon> thanks a lot for helping
<FromGitter> <elorest> Definitely
<FromGitter> <elorest> @valamorgon are you still there?
<FromGitter> <elorest> I set up this and it works as expected. I'm just saving Set-Cookie and sending it back as Cookie. ⏎ ⏎ https://gist.github.com/elorest/96b2636ab59fd57798fe5c301bd34449
<FromGitter> <elorest> Also tried postman and it works.
<FromGitter> <valamorgon> I had to leave for work, I ll try again when I return home. Thanks a lot for your helps. I ll write the results.
<FromGitter> <alex-lairan> Hi, ⏎ ⏎ I am creating a JWT auth with
<FromGitter> <alex-lairan> Hi, ⏎ ⏎ I am creating a JWT auth with Amber, but I don't understand how to do it. (My first time with JWT) ⏎ ⏎ Should I encode the current user info ? ... [https://gitter.im/amberframework/amber?at=5caca9a0759abc043c91ea2c]
<FromGitter> <Blacksmoke16> normally its a single secret key, can store in ENV or something to keep it safe, or like secret.yml if thats a thing
<FromGitter> <Blacksmoke16> you'd normally encode like the userId plus the standard JWT fields like `iss`, `aud`
<FromGitter> <Blacksmoke16> but can also include whatever you want, like array of scopes/roles of that user etc
<FromGitter> <Blacksmoke16> is pretty flexible
<FromGitter> <Blacksmoke16> @alex-lairan
<FromGitter> <alex-lairan> Ok, so it's normal to store `{ user_id: ID }` as a encode ?
<FromGitter> <alex-lairan> The thing that the secret key is always the same simplify my life 😂
<FromGitter> <Blacksmoke16> granted there are various ways to handle it
<FromGitter> <Blacksmoke16> sec
<FromGitter> <Blacksmoke16> https://blog.logrocket.com/how-to-secure-a-rest-api-using-jwt-7efd83e71432 read that a while ago, might help
<FromGitter> <Blacksmoke16> yea, depending on what your client is, can include anything in the body of it
<FromGitter> <Blacksmoke16> common to just have user_id and have like `aud` set to their name. then use the JWT as the token for front end session
<FromGitter> <Blacksmoke16> so user_id can be used to look them up on api requests, and have name already there for simple UI stuff
feepbot has quit [Remote host closed the connection]
feepbot has joined #amber