We are working on a django backend using django-ninja for all the APIs. The backend is deployed on a test server for our colleague who works on the react frontend. We have a login endpoint making use of djangos native authentication functionality. This seems to work if we test it using the swagger ui api doc page.
However we are having issues with the frontend. We can login successfully from the frontend (running on localhost) but somehow the browser does not keep sending the returned cookie with the session_id and the csrf_token for all the subsequent calls.
we are using the following cors and cookie setting and have tried finding a configuration that works:
CORS_ALLOW_HEADERS = default_headers
CORS_ALLOW_ALL_ORIGINS = True
CORS_ALLOW_CREDENTIALS = True
ALLOWED_HOSTS = ["*"]
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = "None"
CSRF_COOKIE_SECURE = True
Since we are not using the ssl protocol for development. We keep getting a warning in the browser saying we can not set Samesite None and secure over an unsecure connection. I think this may be the issue that is causing the authentication to not properly work.
What would be the best way to resolve this? Do people usually use ssl for development? Can I somehow resolve this on the backend?
thin_paperclip is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.