DEV Community

Discussion on: Securely Storing JWTs in (Flutter) Web Apps

 
carminezacc profile image
Carmine Zaccagnino • Edited

Yes, exactly.

Also, the cookies are saved automatically in the document.cookie just like they would if you were writing regular JS.
Unless they're httpOnly: in that case the frontend can never access them so they can be accessed only by the backend when you send a request.

Thread Thread
 
chitgoks profile image
chitgoks

cool. ill check.

i can understand that but somehow its weird that the response header doesnt show the cookie after login.

Thread Thread
 
chitgoks profile image
chitgoks

hi carmine. it seems that the problem is req.cookies returns null in the backend when flutter web sends a request to the backend.

also set httpOnly to false so i could see document.cookie contents but nothing is saved to the browser. weird.

Thread Thread
 
jsonpoindexter profile image
Jason Poindexter

I am also having the same issue. I can see the Set-Cookie header in the login response but the cookie is not actually being set

Thread Thread
 
carminezacc profile image
Carmine Zaccagnino

@chitgoks and @jsonpoindexter I've noticed that. Google's HTTP library seems to not retain cookies sometimes. Switching to the dio http library should fix it in my experience, and Dio's API is very close to Google's. I'm sorry for the late response but I've not been loggin in to dev.to often lately.

Thread Thread
 
jsonpoindexter profile image
Jason Poindexter • Edited

Thank you for taking the time to respond @carminezacc ! What ended up working for me was setting the withCredentials parameter for the BrowserClient to true (it is defaulted to false). After that, my browser did all the cookie management!
github.com/dart-lang/http/blob/20e...