Allow auth webhook to set cookies on response

Hasura does not currently (unless I’m doing something wrong) forward the Set-Cookie header from auth webhooks. This issue is similar to but different from #1654

Use cases:

• Setting a tracking cookie on unauthenticated requests
• Resetting cookie maxAge on each request. This would be very useful for cookies that expire within a set, short amount of time.

One option would be to forward the Set-Cookie header set by auth webhook to the response.

Another, more explicit option would be for the webhook to explicitly respond with a cookies object, and for those to be set on the response.

Here are two possible syntaxes for the auth webhook response:

{
    "X-Hasura-User-Id": "25",
    "X-Hasura-Role": "user",
    "X-Hasura-Is-Owner": "true",
    "X-Hasura-Custom": "custom value",
    "Cookies": {
        "<cookie-name>": {
            "Value": "<cookie-value>",
            "Expires": "<date>"
            "Max-Age": <non-zero-digit>,
            "Domain": "<domain-value>",
            "Path": "<path-value>",
            "Secure": <boolean>,
            "HttpOnly": <boolean>,
            "SameSite": "<Strict/Lax>"
        }
    },
    "Cookies": [
        {
            "Name": "<cookie-name>",
            "Value": "<cookie-value>",
            "Expires": "<date>"
            "Max-Age": <non-zero-digit>,
            "Domain": "<domain-value>",
            "Path": "<path-value>",
            "Secure": <boolean>,
            "HttpOnly": <boolean>,
            "SameSite": "<Strict/Lax>"
        }
    ]
}

Another, even more general purpose way would be to allow a special headers property. This would allow the webhook to set any header. Example syntaxes:

{
    "X-Hasura-User-Id": "25",
    "X-Hasura-Role": "user",
    "X-Hasura-Is-Owner": "true",
    "X-Hasura-Custom": "custom value",
    "Response-Headers": [
        {
            "name": "Set-Cookie",
            "value": "<cookie-name>=<cookie-value>; Expires: <date>; Max-Age: <non-zero-digit>; Domain: <domain-value>; Path: <path-value>; Secure: <boolean>; HttpOnly: <boolean>; SameSite: <Strict/Lax>",
        }
    ],
    "Response-Headers": [
        "Set-Cookie: <cookie-name>=<cookie-value>; Expires: <date>; Max-Age: <non-zero-digit>; Domain: <domain-value>; Path: <path-value>; Secure: <boolean>; HttpOnly: <boolean>; SameSite: <Strict/Lax>",
    ]
}

[pcmaffey]

This issue is critical to being able to fully use auth webhook securely (storing token in cookie instead of localStorage). Will this be addressed ever?

[dionjwa]

Would it be possible to have any visibility into this feature? Hasura is great. Not having access to cookies as an authentication mechanism is frustrating. I see that you may not want to pile too much into the auth webhook, but you are going to get a lot of feature requests there since it’s the main mechanism to auth/filter/control/manipulate/monitor all the requests.