[Bug]: Hosted backend API doesn't return app.idt cookie and /app/me is not available (in strict mode) when the openid scope is requested #3054
Description
What happened?
I wrote the simplest web page to test the API at https://fusionauth.io/docs/apis/hosted-backend, but despite using the openid scope in my request, the app.idt cookie isn't returned as expected.
I then tried making a fetch request to the /app/me endpoint, as the app.at was correctly returned, but this endpoint doesn't exist.
To reproduce:
- Download the repository at https://github.com/ritza-co/fusionauth-example-docker-compose/tree/main/light, cd into the light folder, and
docker compose up. - Create the file
index.htmlwith the content below:
<!DOCTYPE html>
<html>
<head><title>Hosted backend app</title></head>
<body><a href="#" id="loginLink">Log in</a></body>
<script>
const AUTH_URL="http://localhost:9011/app/login/E9FDB985-9173-4E01-9D73-AC2D60D1DC8E";
const AUTH_CALLBACK_URL="http://localhost:3000/auth/callback"
function setupLogin() {
const state = Math.random().toString(36).substring(2, 15);
localStorage.setItem('auth_state', state);
const authorizeUrl = AUTH_URL + `?redirect_uri=${encodeURIComponent(AUTH_CALLBACK_URL)}&state=${state}&scope=openid`;
document.getElementById('loginLink').addEventListener('click', function(event) {
event.preventDefault();
window.location.href = authorizeUrl;
});
}
async function handleCallback() {
const urlParams = new URLSearchParams(window.location.search);
const callbackState = urlParams.get('state');
const storedState = localStorage.getItem('auth_state');
localStorage.removeItem('auth_state');
if (callbackState != storedState)
return alert("State check returned from authentication server does not match saved state");
// ERROR - app.idt cookie missing, despite requesting openid scope - https://fusionauth.io/docs/apis/hosted-backend#request
const response = await fetch('http://fa:9011/app/me');
// ERROR /app/me url not found, despite being in docs - https://fusionauth.io/docs/apis/hosted-backend#me
const data = await response.json();
console.log(data);
window.location.href = 'http://localhost:3000';
}
if (window.location.pathname != '/auth/callback')
setupLogin();
else
handleCallback();
</script>
</html>- Run the app with
docker run --init -it --rm --name "app" -v ".:/app" -w "/app" -p 3000:3000 --network faNetwork node:23-alpine3.19 sh -c "npm install http-server && npx http-server -d false -a 0.0.0.0 -p 3000 --proxy http://localhost:3000?"and browse to http://localhost:3000 - Log in to FA with the log in link and
[email protected]andpassword. - Notice in your browser dev tools that the
app.idttoken wasn't returned and the fetch call to/app/mefailed.
Version
1.57.0
Affects Versions
No response
Alternatives / Workarounds
None. This completely blocks a serverless app from finding the username of the logged in user, as the app.at cookie is HttpOnly.