https://www.ory.sh/ logo
Join Slack
Powered by
Hello everyone, it’s me again :see_no_evil: . I ha...
# ory-network
g
Hello everyone, it’s me again 🙈 . I have trouble with our local development setup (mobile application -> oathkeeper/ory-cloud -> backend) in which requests using the 
X-Session-Token
header are never successfully authenticated. Weirdly enough, the same code base and configuration (with adjusted hostnames etc.) works just fine in our 
staging
and 
production
environments. It seems only 
localhost
makes it a difference. Any idea on your side if that could e.g. be related to special treatment of 
localhost
?
I found the solution (after hours of debugging and minutes after posting :/)… Looking at https://www.ory.sh/docs/guides/session-management/overview#session-token I could see that there are two options of passing the session token (for our mobile app): • 
X-Session-Token: XYZ
• 
Authorization: Bearer XYZ
It seems that Oathkeeper only forwards the 
Authorization
header, not the 
X-Session-Token
header which is IMO a usability bug. Oathkeeper and Kratos / Ory cloud should work more nicely together here.
At least the documentation for 
bearer_token
could explicitly mention that 
X-Session-Token
must be configured and give an example on how to do so.
h
Oh yes, you’re absolutely right, Oathkeeper should play much nicer with the API here. This is a great find, thank you! Have you been able to resolve the problem with a config value, or is it just not working?
g
I had configured before on our staging / production environments to use 
X-Session-Token
. Weirdly, this didn’t work on a local setup, so that’s when I debugged and eventually changed to use the 
Authorization
header.
Another thing I noticed: using 
LOG_LEAK_SENSITIVE_VALUES
actually does lead to logging of sensitive values in the case of the 
cookie_session
authenticator (cookie headers are being logged). Using the 
bearer_token
, it would neither log 
X-Session-Token
, nor 
Authorization
headers, but all others. Obviously, this led me down a wrong path debugging my app (we use cookies for web, bearer_token for mobile) if it correctly adds those headers, even ending up using Wireshark to make sure they actually do go over the wire 🙈 . Also, here my expectation is that using 
LOG_LEAK_SENSITIVE_VALUES
would also log 
X-Session-Token
and 
Authorization
headers.
h
In which project? Oathkeeper?
g
@high-optician-2097 Yes.
4 Views
Open in Slack
PreviousNext
Powered by