Angular 8 ngx-cookie 2.4 not able to read from FireFox (even though its present) but works on Chrome/Edge

Viewed 514

Environment

  • WebAPI (.NET Core v3)
  • Angular (v8)
  • Ngx-Cookie (v2.4)
  • VS 2019 Integrated Project template (Angular + WebAPI combined)

Problem Statement

In our application, WebAPI calls the angular app and sets a cookie having auth tokens in the request. To comply with the present security, SameSite=strict, Secured=True is set, along with a timeout of 15min. The angular app reads the cookie in ng-init event using ngx-cookie-service instance. The cookie service isn't able to read the cookie in FireFox (v74.a.b.c), but works fine in Chrome (v80.a.b.c) and Edge (v 18363). We tried to place a debugger just before the cookie reading and checked the cookie's presence under Storage and it was present all right. Even manually when we execute the cookie service, it is unable to find.

However, when we come back to this route again, the cookie service is able to read the cookie successfully and perform further work properly. We thought that this may be due to execution time difference that read operation is done earlier than the write, so placed a setTimeout but it's still not working.

Code

WebAPI

CookieOptions cookieOptions = new CookieOptions()
{
   Secure = true,
   Expires = DateTime.Now.AddMinutes(tokenExpirationTimeout),
   IsEssential = true,
   SameSite = SameSiteMode.Strict
};

Angular

ngOnInit() {    
setTimeout( () => {
  var authToken = this.cookieService.get("AuthToken");
  if (!authToken || authToken.length == 0) {
    console.error("Authentication token not received");
    this.router.navigate(["auth-failed"]);
  }
  this.StoreService.setUserName(
    this.cookieService.get("userName")
  );
  this.router.navigate(["archive"]);
},
  5000);
}

Note: for angular, the setTimeout call is added to delay to check read vs write difference, but doesn't helps. We always get empty cookie

If we redirect manually to this route again, the cookie is readily read.

Both angular and webapi are deployed in same app within Azure App Service, so no issues regarding CSRF/SameSite issues and also the HTTPS is taken care of.

Screenshot of FireFox enter image description here

(Update: Disabled Enhanced Security Protection as well as explicitly allowed cookie storage) enter image description here

0 Answers
Related