0

Session information is not being maintained when APIs invoked via the VueJs. In the sails backend, login action set the user id to the session. Whereas in the sessionAuth policy I am simply checking for the user id in the req session.

  module.exports = async function (req, res, next) {

  // User is allowed, proceed to the next policy, 
  // or if this is the last policy, the controller
  const id = req.session.userId;
  if (id) {
    const user = await User.findOne({ id });
    req.user = user;
    if (user) {
      return next();
    }
  }


  // User is not allowed
  // (default res.forbidden() behavior can be overridden in `config/403.js`)
  return res.forbidden('You are not permitted to perform this action.');
  };

The above policy works perfectly when requests are being made from Postmen. I invoke login action, any action invoked after that does have user id set in the session. But if the same sequence is followed in a web application user id is missing from the session even after the successful login.

Login component

 axios.post(`${this.$config.baseUrl}/login`, this.user)
        .then(res => {
          this.$router.push({ path: "/home" });
        })

Component accessing secured data

  const response = await axios.get(`${baseUrl}/course`
      return { courseList: response.data };
    }
kunal
  • 779
  • 6
  • 25
  • please show relevant vue code which makes the request – Lawrence Cherone Jul 18 '20 at 18:35
  • Updated the post, I have added only the parts where APIs are invoked. – kunal Jul 18 '20 at 19:09
  • Does this answer your question? [Make Axios send cookies in its requests automatically](https://stackoverflow.com/questions/43002444/make-axios-send-cookies-in-its-requests-automatically) – Lawrence Cherone Jul 18 '20 at 19:16
  • Unfortunately adding {withCredentials: true} to my API requests didnt work form. – kunal Jul 20 '20 at 12:48
  • are you getting a session cookie/header back when using postman? can you make the initial request with vue/axios? what error is it showing? withCredentials should work fine presuming its not CORS and you have properly setup express to handle and maintain sessions – Lawrence Cherone Jul 20 '20 at 13:40

0 Answers0