Edit: This matter has been resolved. The issue lied somewhere in the

session_cookie

authenticator configuration of Oathkeeper. For my case specifically it was related to preserving path & query. At first I thought that CORS had a hand in this but it seems that wasn't the case. The cookies were being sent but for some reason Oathkeeper was requesting the path of the original API call from Kratos instead of

/sessions/whoami

and was getting 404 errors. Hello everybody! I'm working on integrating Ory services into my project. I used to have Kratos, Hydra, Keto and Oathkeeper but it was pointed out to me that Hydra was not required for my use case so I'm currently dropping it. I got to the point of authenticating requests via the Kratos session cookies against Oathkeeper, however I always get 401s. I think the cookie isn't being given to the

/sessions/whoami

endpoint of Kratos. In Postman I tried setting the cookie by getting it from the browser headers after logging in to the domain that was set in the kratos.yml configuration -

.projectname.example.app

and it didn't work but when I set the domain to

kratos.projectname.example.app

the whoami endpoint worked. Here are parts of my configs: `kratos.yml`:

serve:
    admin:
        base_url: <https://kratos-admin.projectname.example.app/>
    public:
        base_url: <https://kratos.projectname.example.app/>
        cors:
            enabled: true
            debug: true
            allowed_origins:
                - "<https://projectname.example.app>"
                - "<https://api.projectname.example.app>"

cookies:
    domain: .projectname.example.app
    path: /
    same_site: Lax

session:
    cookie:
        domain: .projectname.example.app
        path: /
        same_site: Lax

`oathkeeper.yml`:

serve:
 proxy:
  port: 4455 # run the proxy at port 4455
  trust_forwarded_headers: true
  cors:
   enabled: true
   allow_credentials: true
   allowed_origins:
    - "*"

 api:
  port: 4456 # run the api at port 4456
  cors:
   enabled: true
   allow_credentials: true
   allowed_origins:
    - "*"

authenticators:
 noop:
  enabled: true
 anonymous:
  enabled: true
  config:
   subject: guest
 cookie_session:
  enabled: true
  config:
   check_session_url: <https://kratos.projectname.example.app/sessions/whoami>
   preserve_host: true
   preserve_query: true
   extra_from: "@this"
   subject_from: "identity.id"
   only:
    - ory_kratos_session

rules.json

(for Oathkeeper):

{
  "id": "protected-resources",
  "description": "Strictly protects all known API resources. Requires valid Cookie.",
  "upstream": {
    "url": "<http://192.168.6.8:8393/>"
  },
  "match": {
    "url": "URL here...",
    "methods": [
      "GET",
      "POST",
      "PUT",
      "PATCH",
      "DELETE",
      "OPTIONS"
    ]
  },
  "authenticators": [
    {
      "handler": "cookie_session"
    }
  ],
  "authorizer": {
    "handler": "allow"
  },
  "mutators": [
    {
      "handler": "id_token"
    }
  ]
}