无法在 Golang 中读取 cookie（路由器：chi）

Question

我正在为 todolist 应用程序开发 REST API（不是来自教程），并且我已经成功实现了身份验证，但是我的一个辅助函数似乎无法读取明显存在的 cookie，这里是函数：

// jwt is imported from the https://github.com/dgrijalva/jwt-go package

func validateAccessToken(w http.ResponseWriter, r *http.Request) uuid.UUID {

    jwtSecret, exists := os.LookupEnv("JWT_SECRET")

    if !exists {

        w.WriteHeader(500)

        w.Write([]byte(`{"message":{"error":"Fatal internal error occurred"}}`))

        panic(errors.New("JWT_SECRET environment variable not set"))

    }

    // Get access token and then validate it

    at, err := r.Cookie("access_token")

    if err == http.ErrNoCookie {

        w.WriteHeader(401)

        w.Write([]byte(`{"message":{"error":"access_token cookie not found"}}`)) // this error is always returned when i attempt to use the handler that uses this function

        return uuid.Nil

    }

    t := at.Value

    token, err := jwt.ParseWithClaims(t, &models.UserClaims{}, func(token *jwt.Token) (interface{}, error) {

        return []byte(jwtSecret), nil

    })

    if claims, ok := token.Claims.(*models.UserClaims); ok && token.Valid {

        return claims.ID

    }

    w.WriteHeader(401)

    w.Write([]byte(`{"message":{"error":"access_token invalid"}}`))

    return uuid.Nil

}

这是设置cookie的代码的相关部分：

// Login handles the login route

func Login(w http.ResponseWriter, r *http.Request) {

    //...

    // Construct cookies and then set them

    rtCookie := http.Cookie{

        Name:    "refresh_token",

        Value:   *rt,

        Expires: time.Now().Add(time.Nanosecond * time.Duration(sessionLifeNanos)),

    }

    atCookie := http.Cookie{

        Name:    "access_token",

        Value:   *at,

        Expires: time.Now().Add(time.Minute * 15),

    }

    http.SetCookie(w, &rtCookie)

    http.SetCookie(w, &atCookie)

    w.Write([]byte(`{"message":"Logged in successfully :)"}`))

}

此外，每当我在邮递员中使用登录路由后进行检查时，所有 cookie 都会发送到 cookie jar 中（并且没有“access_token”cookie 未过期），并且具有正确的外观值。我很困惑为什么该validateAccessToken()函数找不到那里的cookie，这里也是serve()调用的函数main()：

我非常感谢任何帮助的尝试，我也为这个糟糕的问题道歉，我有点急于完成这个。

Answer 1

应用程序将 cookie 路径隐式设置为登录处理程序路径。通过将 cookie 路径显式设置为“/”来修复。rtCookie := http.Cookie{&nbsp; &nbsp; Name:&nbsp; &nbsp; "refresh_token",&nbsp; &nbsp; Path:&nbsp; &nbsp; "/", // <--- add this line&nbsp; &nbsp; Value:&nbsp; &nbsp;*rt,&nbsp; &nbsp; Expires: time.Now().Add(time.Nanosecond * time.Duration(sessionLifeNanos)),}atCookie := http.Cookie{&nbsp; &nbsp; Name:&nbsp; &nbsp; "access_token",&nbsp; &nbsp; Path:&nbsp; &nbsp; "/", // <--- add this line.&nbsp; &nbsp; Value:&nbsp; &nbsp;*at,&nbsp; &nbsp; Expires: time.Now().Add(time.Minute * 15),}

Answer 2

我不确定，但我认为问题可能是由于 SameSite cookie 政策而出现的。如果您使用现代浏览器版本从在不同端口上运行的前端测试程序，则可能是浏览器不发送 cookie，因为它们没有SameSite 属性。尝试将您的代码更改为：rtCookie := http.Cookie{&nbsp; &nbsp; &nbsp; &nbsp; Name:&nbsp; &nbsp; "refresh_token",&nbsp; &nbsp; &nbsp; &nbsp; Value:&nbsp; &nbsp;*rt,&nbsp; &nbsp; &nbsp; &nbsp; SameSite: http.SameSiteNoneMode,&nbsp; &nbsp; &nbsp; &nbsp; Expires: time.Now().Add(time.Nanosecond * time.Duration(sessionLifeNanos)),&nbsp; &nbsp; }