Need recommendation on my solution
I am having a multi-tenant product in the SaaS architecture means the same API is common for all the clients. so we hosted in the common domain (xyz.com).
but we having N number of frontend client ( ex: abc.com, fb.com, test.com).
we need to store a user's logged info in the token via a cookie. what is the best way to achieve this?
Problem is:
Getting invalid domain attribute with regards to the current host URL while setting cookies in the browser. chrome's F12 window network response screenshot
my website is running in abc.com now and API is hosted at xyz.com.
Trying to set a cookie with the domain as abc.com in Ajax call from abc.com to xyz.com, but getting above warring in the browser and cookie is not set.
But if I set the cookie domain as xyz.com, then the cookie is setting in abc.com.
My Conclusion:
Brower will accept the cookie only from the API's domain( UI - there is a way to skip - samesite). So I can make my cookie as an HTTP only and secure cookie.
xsrf-token -> will be in http only secure cookie x-xsrf-token -> will be in local storage
so that it will be safe from XSS and CSRF(Edited)