DRM Cookie Authentication page does not store cookie

Have you read the FAQ and checked for duplicate open issues? Yes

What version of Shaka Player are you using? 2.5.20

Can you reproduce the issue with our latest release version? Yes

Can you reproduce the issue with the latest code from master? N/A

Are you using the demo app or your own custom app? Demo and custom

If custom app, can you reproduce the issue using our demo app? N/A

What browser and OS are you using? Chrome (Version 88.0.4324.192)- Mac Catalina (10.15.7)

For embedded devices (smart TVs, etc.), what model and firmware version are you using? N/A

What are the manifest and license server URIs? Manifest - https://storage.googleapis.com/shaka-demo-assets/sintel-widevine/dash.mpd DRM server - https://cwip-shaka-proxy.appspot.com/cookie_auth

What did you do? Following the DRM tutorial and attempting to set the cookie auth option for DRM.

Setup request filter to allow cross site credentials as detailed in instructions (before player.load())

  player.getNetworkingEngine().registerRequestFilter(function(type, request) {
    if (type == shaka.net.NetworkingEngine.RequestType.LICENSE) {
      request.allowCrossSiteCredentials = true;
    }
  });

What did you expect to happen? Visit set_cookie page (https://cwip-shaka-proxy.appspot.com/set_cookie), visit player page, cookie persists and playback is allowed (no error 6007)

What actually happened? When visiting the set_cookie page then the cookie is set (can see it is with the document.cookie() call) but navigating back to the player page does not have the cookie stored and the player throws a 6007 error

[joeyparrish]

That did the trick! I’m not sure when the “Secure” cookie attribute became a requirement, but we haven’t held any training classes since 2019, so that particular tutorial hasn’t been checked in a while. The fix has been deployed to the cwip-shaka-proxy service.

Thanks, @TheModMaker, for the fix, and @Alpenglow88 for pointing out the issue.

[TheModMaker]

Can we set the cookie’s settings to allow cross-origin access? Does this doc help https://web.dev/samesite-cookies-explained/?

For example, can the server set CWIP-Auth-Cookie=abc; SameSite=None; Secure?