Send http-only cookie into Edge Function

saillmone · 2025-07-15T12:59:26.766+00:00

Hi,I can't retrieve the values of HttpOnly cookies.req.headers.get('cookie') are always null, I don't understand where the error is coming from...Can someone help me solve this problem?Thank you!

saillmone

3 months ago

Hi,

I can't retrieve the values of HttpOnly cookies.
req.headers.get('cookie') are always null, I don't understand where the error is coming from...
Can someone help me solve this problem?

Thank you!
Jay Campbell

3 months ago

What cookies are you trying to send? Like the access token?
saillmone

3 months ago

refresh_token in order to refreshSession and then store the new values for access_token and refresh_token
Jay Campbell

3 months ago

Ah I didn’t see the code. What you can do is in headers add one called something like x-refresh-token, and set its formula to get the http-only cookie.

Then in your edge function you can pull get that header.
saillmone

3 months ago

Yes, it works like that, but it's not ideal in terms of security, is it?

I'd like to be able to switch them to secure cookies.
Jay Campbell

3 months ago

Hmm well first, just to make sure but you saved the cookie as refresh-token, not refresh_token right? Since you’re checking for refresh-token.
saillmone

3 months ago

Wooow, didn't notice that I was missing it..But that doesn't change the issue : req.headers.get('cookie') is always NULL.

It seems that something blocks for security reason.
MartinF

3 months ago

I use X-Access-Token and then pass the value from the get http only cookie formula. The proxy then substitutes in the cookie value and the edge function then has the value.
MartinF

3 months ago

You have to use the proxy which you look to be doing, else you can try the new 'Client-side credentials' = include feature and then look in the network tab to see what is being passed. Not tried this yet but this should let you bypass the proxy although there will be cors fun to deal with. So you might need to make your own proxy. I'd keep the proxy on and then send values as shown.
Andreas Møller

3 months ago

We don’t pass the http only cookies on by default
Instead you can pass it as an auth header

Send http-only cookie into Edge Function

saillmone

Jay Campbell

saillmone

Jay Campbell

saillmone

Jay Campbell

saillmone

MartinF

MartinF

Andreas Møller