Issue with login to Gitlab in nodejs application

Viewed 35

I'm trying to authenticate to Gitlab in my nodejs app, but cant get "known_sign_in" cookie in response.

Steps I reproduce:

  1. get git.mycompany.com/users/sign_in, get csrf-token from page

  2. get _gitlab_session cookie from response

  3. post request to git.mycompany.com/users/auth/ldapmain/callback with data above and my creds.

    Body of request: utf8=%E2%9C%93&authenticity_token=%TOKEN%&username=%USERNAME%&password=%PASSWORD%

    It looks like body on UI: enter image description here

also I set headers:

headers: {
    "Content-type": "application/x-www-form-urlencoded",
},

like on UI too

Also I reproduces this steps via Postman, it works nice: I got "known_sign_in" cookie which means that authentication is successfull. But when I try to do this in my nodejs app, there is no such cookie in response.

Code:

function loginToGitlab() {
    fetch("https://git.mycompany.com/users/sign_in")
        .then(async res => {
            const text = await res.text();
            const parser = new DOMParser();
            const html = parser.parseFromString(text, 'text/html');
            const token = html.getElementsByAttribute("name", "csrf-token")[0].getAttribute("content");
            
            const sessionCookie = res.headers.get('set-cookie').match(/([\s\S]*?);/)[1];
            return { token, sessionCookie };
        })
        .then(({ token, sessionCookie }) => {
            fetch("https://git.mycompany.com/users/auth/ldapmain/callback", {
                method: 'POST',
                credentials: "include",
                headers: {
                    "Content-type": "application/x-www-form-urlencoded",
                    "cookie": sessionCookie,
                },
                body: `utf8=%E2%9C%93&authenticity_token=${encodeURIComponent(token)}&username=${username}&password=${password}`,
            }).then(res => console.log(res.headers))
        });
}

I logged cookie and token from request, they are nice.

Response (headers):

{
  'cache-control': 'max-age=0, private, must-revalidate',
  connection: 'close',
  'content-encoding': 'gzip',
  'content-type': 'text/html; charset=utf-8',
  date: 'Thu, 08 Sep 2022 17:15:21 GMT',
  'permissions-policy': 'interest-cohort=()',
  'referrer-policy': 'strict-origin-when-cross-origin',
  server: 'nginx',
  'set-cookie': '_gitlab_session=%COOKIE%; path=/; expires=Thu, 08 Sep 2022 19:15:21 GMT; secure; HttpOnly; SameSite=None',
  'strict-transport-security': 'max-age=31536000',
  'transfer-encoding': 'chunked',
  vary: 'Accept-Encoding',
  'x-content-type-options': 'nosniff',
  'x-download-options': 'noopen',
  'x-frame-options': 'DENY',
  'x-gitlab-feature-category': 'authentication_and_authorization',
  'x-permitted-cross-domain-policies': 'none',
  'x-runtime': '0.058164',
  'x-ua-compatible': 'IE=edge',
  'x-xss-protection': '1; mode=block'
}

There is no "known_sign_in" cookie :( Please help!

0 Answers
Related