I'm trying to authenticate to Gitlab in my nodejs app, but cant get "known_sign_in" cookie in response.
Steps I reproduce:
get
git.mycompany.com/users/sign_in, get csrf-token from pageget _gitlab_session cookie from response
post request to
git.mycompany.com/users/auth/ldapmain/callbackwith data above and my creds.Body of request:
utf8=%E2%9C%93&authenticity_token=%TOKEN%&username=%USERNAME%&password=%PASSWORD%It looks like body on UI:

also I set headers:
headers: {
"Content-type": "application/x-www-form-urlencoded",
},
like on UI too
Also I reproduces this steps via Postman, it works nice: I got "known_sign_in" cookie which means that authentication is successfull. But when I try to do this in my nodejs app, there is no such cookie in response.
Code:
function loginToGitlab() {
fetch("https://git.mycompany.com/users/sign_in")
.then(async res => {
const text = await res.text();
const parser = new DOMParser();
const html = parser.parseFromString(text, 'text/html');
const token = html.getElementsByAttribute("name", "csrf-token")[0].getAttribute("content");
const sessionCookie = res.headers.get('set-cookie').match(/([\s\S]*?);/)[1];
return { token, sessionCookie };
})
.then(({ token, sessionCookie }) => {
fetch("https://git.mycompany.com/users/auth/ldapmain/callback", {
method: 'POST',
credentials: "include",
headers: {
"Content-type": "application/x-www-form-urlencoded",
"cookie": sessionCookie,
},
body: `utf8=%E2%9C%93&authenticity_token=${encodeURIComponent(token)}&username=${username}&password=${password}`,
}).then(res => console.log(res.headers))
});
}
I logged cookie and token from request, they are nice.
Response (headers):
{
'cache-control': 'max-age=0, private, must-revalidate',
connection: 'close',
'content-encoding': 'gzip',
'content-type': 'text/html; charset=utf-8',
date: 'Thu, 08 Sep 2022 17:15:21 GMT',
'permissions-policy': 'interest-cohort=()',
'referrer-policy': 'strict-origin-when-cross-origin',
server: 'nginx',
'set-cookie': '_gitlab_session=%COOKIE%; path=/; expires=Thu, 08 Sep 2022 19:15:21 GMT; secure; HttpOnly; SameSite=None',
'strict-transport-security': 'max-age=31536000',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding',
'x-content-type-options': 'nosniff',
'x-download-options': 'noopen',
'x-frame-options': 'DENY',
'x-gitlab-feature-category': 'authentication_and_authorization',
'x-permitted-cross-domain-policies': 'none',
'x-runtime': '0.058164',
'x-ua-compatible': 'IE=edge',
'x-xss-protection': '1; mode=block'
}
There is no "known_sign_in" cookie :( Please help!