App service node - cookies blocked in production

VTEX in your native language 🌎 Portuguese
,
1

We developed an app on the node builder. It’s an API system that adds a Set-Cookie header, setting a cookie in the user’s browser as they browse the store.

Since the node app is available on the store’s domain, it’s possible to save first-party cookies this way.

The problem is that the cookie only reaches the controller in dev mode — when we deploy to prod, almost all cookies stop coming through.

I’m retrieving the cookie like this:

ctx.request.headers.cookie:

in dev: complete

in prod: reduced (doesn’t send the cookie we created)

So, since we validate whether the created cookie comes back in the browser’s request, and it doesn’t come back in prod, we’re stuck in a loop creating a new cookie on every request… because the cookie we set never comes back.

It looks like VTEX’s Akamai does a cleanup on cookies and has a whitelist of cookies that actually come through in the “cookie” header.

Any solution?

2

Hi Alexandre, good afternoon! How’s it going?

Has this app been published and is it installed on master?

3

Jayne
All good, and you?

Yes, published and installed on master.

4

Hi Alexandre!

Akamai is a WAF and not a VTEX feature.

If it’s working in the development environment, I suggest running a test in the production environment without the WAF, as I believe it may be affecting how the cookies are being read.

Can you run this test, please?

5

@Jay

And how do I disable the WAF? From what I understand, this is within the infrastructure where the VTEX node containers run (apps service).

6

Hi, Alexandre! Good morning,

The WAF is a reverse proxy and sits “in front of” VTEX’s CDN, meaning the final domain is not pointed directly to us. You can check this here.

The deactivation would therefore only occur if the domain were pointed directly to VTEX, as described in the documentation.

Store address: www.site.com
  - Entry (subdomain): www
  - Type: CNAME
  - Destination: www.site.com.cdn.vtex.com

As a reminder, in ticket #919919 we already discussed this topic with you. We also mentioned that one of the possible errors when using a reverse proxy is related to the correct forwarding of Akamai headers or cookies to VTEX.

7

Jay

I understand now, I assumed it was within the VTEX infrastructure, but as you pointed out it is actually related to the client’s DNS model.

I’ll look into it more thoroughly and get back to you