Using an ETS table to store sessions, how do I prevent the set-cookie header from being sent?

Phoenix Forum Questions / Help
, ,
1

Im using an ETS table to store sessions. The Cookie is not used to when accessing the ETS table. How do I prevent the set-cookie header from being sent?

This has no effect:

defmodule Session.RemCookies do
  import Plug.Conn

  def init(opts), do: opts

  def call(conn, _opts) do
    register_before_send(conn, fn conn ->
      # Remove all Set-Cookie headers from response
      %{conn | resp_headers: Enum.reject(conn.resp_headers, fn {key, _} ->
        String.downcase(key) == "set-cookie"
      end)}
    end)
  end
end
2

Even if you have the session stored in ETS, you still need to store the session key as a cookie. Otherwise, how does your application tell which session to use for incoming request?

2 Likes
3

Passed as a query param. Like I said, its not used. Its spec for a reason. Cookie cannot be used.

4

While what you described might be theoretically possible, I don’t think it is supported by Plug.Session. The relevant code is here:

It looks for a cookie.

5

Im not using a cookie because its a distributed service and uses cross site access for different elements on the page… the cookie is ignored.

6

If you are set on your way, I suggest you to write your own version of Plug.Session instead of twisting its arm. Plug.Session is only ~100 LOC.

You’d need to pass this query param for every single internal links, and heaven forbid if one of your user share a link.

1 Like
7

How would you approach otherwise?

8

Can you use a different header?

9

If you have a common host and the services are all subdomains then a wildcard cookie could do the trick and circumvent the problem you mentioned above.

Or use JWT.

10

I do not understand your constraint, so please take the following with a grain of salt.

You can store a security token in local storage and use it as sorta API key in a custom header. 2 downsides:

  • Initial request will not have this key and will not be customized
  • You really need to make sure all javascript you use is trustworthy