Pass the cookie to /cgi/auth.pl

[g123k]

Hi everyone,

Let me explain the issue first.
In the mobile app, we need to call the API to GET the knowledge panels for a product (eg: https://world.openfoodfacts.org/api/v3/product/3017620422003?fields=knowledge_panels)

But more specifically, we want the other than the cookie of the response.
It appears that the only way to get this version is to pass a cookie in the headers.

However, the mobile app uses the /cgi/auth.pl route and in this route (contrary to /cgi/login.pl) the cookie is never passed.

So here, we have two solutions:

• Pass a cookie to /cgi/auth.pl
• Allow the product endpoint to be authenticated other than via a cookie

[hangy]

However, the mobile app uses the /cgi/auth.pl route and in this route (contrary to /cgi/login.pl) the cookie is never passed.

I don't understand. Both URLs call my $request_ref = ProductOpener::Display::init_request();, which uses the session or user+password internally. Am I missing something or should both URLs not behave the same way regarding that?

[g123k]

The only difference is about the response received.
/cgi/auth.pl doesn't contain any set-cookie header

[monsieurtanuki]

More generally, this cookie issue is problematic for Smoothie as there are other actions that cannot be performed without cookie.
For instance, if I want to delete my own account, it's not possible because I need to be logged in first, and I cannot pass my cookie for the additional "delete" action.
I know that for the "prices" API when we log in we can set a cookie (web version) OR retrieve a "bearer token" (API calls from flutter/dart for instance).

[hangy]

For instance, if I want to delete my own account, it's not possible because I need to be logged in first, and I cannot pass my cookie for the additional "delete" action.

Does it have to be done from the app? When moving to Keycloak, we'd probably have to limit that to specific scopes to avoid abuse by other people's apps. I'd rather prefer user deletion to be done from Keycloak in most cases. cc @john-gom

I know that for the "prices" API when we log in we can set a cookie (web version) OR retrieve a "bearer token" (API calls from flutter/dart for instance).

See #9251 for our progress of OIDC auth (with the help of Keycloak)