https://www.ory.com/ logo
Join Slack
Powered by
Hi Ory team, Right now we are pushing our service...
# ory-network
h
Hi Ory team, Right now we are pushing our services to production and is facing some domain, cookies related issue. We have several environments include • dev • staging • production In the dev environment, we are using Ory proxy so there won’t have this kind of cookie issue. But when we move to the staging environment (Which is on the cloud) we are facing an issue that ory can not set the cookie on our domain properly due to the CORS domain cookie issue I guess? (The hydra cookie same_site policy is set to None) My question will be is there a way to make our staging work properly without using the custom domain? Or do we need to pay for another essential plan just for testing in our staging env?
s
you could also deploy the proxy on your staging environment to do the same you do on local
for production workloads we strongly recommend custom domains though
w
Sorry to hijack this thread, but we have Kratos deployed with a cookie domain of test.x.com and let our developers use https://localhost.test.x.com:3000 so that they can share the cookie with the deployed instance. This host is whitelisted under allowed origins and redirect URLs. This requires them to acquire certificates and overwrite using /etc/hosts. Is this something that can be simplified using a proxy?
s
yes totally
w
Thanks @steep-lamp-91158! Is it also possible to deploy the tunnel on our staging cluster or would that impose a security risk, don't think so right as long as we only use the tunnel on developer machines right?
s
you can definitely deploy it, the Ory CLI is also available on dockerhub
from a security perspective it is fine for staging
w
Perfect, thank you @steep-lamp-91158. This will make the team really happy! 😄
Gonna try to set it up and will send you an update either way
The idea is to run it at the same domain as that of the developer right (because ports are not considered)? That means it should be run by the developer and not deployed on staging where kratos is deplyoed right?
s
well if you have a staging environment running on a real domain you have to deploy it there as well
h
@steep-lamp-91158 Thanks for your quick response. We are using Vercel for our frontend code. Is that possible to run Ory proxy along with that or we may need to setup another services
s
```// @ory/integrations offers a package for integrating with Next.js in development. It is not needed in production.
// @ory/integrations works in a similar way as ory tunnel, read more about it what it does:
// https://www.ory.sh/docs/guides/cli/proxy-and-tunnel
import { config, createApiHandler } from "@ory/integrations/next-edge"
// We need to export the config.
export { config }
// And create the Ory Network API "bridge".
export default createApiHandler({
fallbackToPlayground: true,
dontUseTldForCookieDomain: true,
})```
h
Oh, I forgot that integration exists!! I will test it, another question, does this integration works with authorization code flow? Because last time when I implement it I am facing lots of issues
s
I'm not sure about that, maybe start a new thread with the concrete problems you face
m
@high-ram-25481 you should use a CNAME on Vercel in production and ory/integrations only for development (so you dont need a CNAME there). https://www.ory.sh/docs/getting-started/integrate-auth/nextjs#go-to-production I am not sure if it will work with the OAuth2 integration though. #
w
@steep-lamp-91158 does the integration (replacement of tunnel) also works for self-hosted?
3 Views
Open in Slack
PreviousNext
Powered by