https://descope.com logo
Join Slack
Powered by
Hi team, we are currently experiencing a login iss...
# ask-a-descoper
x
Hi team, we are currently experiencing a login issue in Firefox and would appreciate your help investigating it. Background: We have three environments under different subdomains: • app.glasswing.cloud • app.stg.glasswing.cloud • app.integ.glasswing.cloud We observed that when a .glasswing.cloud cookie exists after logging into app.glasswing.cloud, it causes login failures in the other two environments (stg and integ). When inspecting the network requests, the API response indicates JWT validation failure. What we have already tried: • Explicitly setting baseUrl in AuthProvider to ensure each environment uses its correct domain. • Configuring “Refresh token - Manage in cookies” in the Descope Console, with each environment’s domain specified accordingly. However, the .glasswing.cloud cookie still interferes with authentication in other subdomains. This issue only occurs in Firefox. If we manually delete the .glasswing.cloud cookie, login in other environments works normally again. Could you please help verify whether this is expected behavior related to cookie domain scoping or Firefox-specific handling? If possible, we would appreciate guidance on the correct configuration to prevent cross-environment cookie interference. Thank you!
a
Hey @Xiaoen Tang Let me take a look at this
❤️ 1
Hey @Xiaoen Tang, have replied on the ticket
x
Perfect, I've replied with all the details, please check when you have time, thx
🙌 1
a
Hey @Xiaoen Tang Can you please send a screenshot of your AuthProvider component? I need to review the sessionTokenViaCookie configuration set in your frontend
x
Hi @Atharva Joshi, I only pass the baseUrl and projectId into this component. They're both from the environment variables.
👀 1
a
@Rahul Rijhwani can you assist here?
r
Sure let me take a look
Hi @Xiaoen Tang In your 
AuthProvider
configuration, you can also control cookie settings including the cookie name. If you need different cookie names per environment to avoid conflicts, you can set the 
cookieName
option:
Copy code
<AuthProvider
  projectId="your-project-id"
  sessionTokenViaCookie={{ cookieName: 'sessionToken' }}
  baseUrl="<https://auth.app.glasswing.cloud>"
  baseStaticUrl="<https://auth.app.glasswing.cloud/pages>"
>
...
</AuthProvider>
The key is ensuring that the cookie domain in your Descope Console configuration for "Refresh token - Manage in cookies" matches the specific subdomain for each environment, not the parent domain 
.glasswing.cloud
. check below docs: https://docs.descope.com/security-best-practices/crossite-cookies https://docs.descope.com/client-sdk/descope-components
x
Perfect, I will have a look, thx
Hi @Rahul Rijhwani, as recommended, I've added these props to the AuthProvider, and then update the session storage in Descope console. And I've also updated the cookieNames in the sign-up-or-in flow, I can see the cookies with new name generated after logging in, but the rendering is now blocked. Could you please help me with that? Thanks
a
Hey @Xiaoen Tang, can you elaborate on "the render is blocked"? Im not sure i understand. Is the cookie being set properly this time?
x
Yeah, the cookies are set with the custom name after I update the flow, But the AuthProvider seems not to be using it because all the contents are its child components. Nothing happens after logging in, the tab stays in the sign-in page after that.
a
okay so it doesnt redirect at all after auth? any errors in console or network tab? is the redirectAfterSuccess prop set in the descope component?
x
Yeah, there is an refresh api error saying no jwt. I can give you an screenshot, currently away from keyboard. I didn't set any redirect logic in the UI, just put a redirect url in the Descope console but it didn't redirect me.
a
please send the exact error in the API call when your able to this will help us debug a cf ray of the failed request would be very helpful as well I'd like some more details about your auth method and where the redirect is set exactly
x
Hi @Atharva Joshi, first three screenshots are my settings in the code and Descope console (Project id: P2y1kV1yOglxS9WdfX7F3zN9mRLd). The fourth one is where we set the redirect url, but it's not redirecting us to the target, even though the onSuccess callback function is called after logging in. The result is I'm stuck in an empty sign-in page.
👀 1
Copy code
curl '<https://app.integ.glasswing.cloud/sign-in>' \
  -H 'accept: */*' \
  -H 'accept-language: en-AU,en;q=0.9,zh-CN;q=0.8,zh;q=0.7,de;q=0.6' \
  -b 'cc_cookie=%7B%22categories%22%3A%5B%22necessary%22%2C%22analytics%22%5D%2C%22revision%22%3A0%2C%22data%22%3Anull%2C%22consentTimestamp%22%3A%222025-12-08T04%3A04%3A51.185Z%22%2C%22consentId%22%3A%2256448b90-baf0-49c5-b3c7-10574af40ede%22%2C%22services%22%3A%7B%22necessary%22%3A%5B%5D%2C%22analytics%22%3A%5B%5D%7D%2C%22languageCode%22%3A%22en%22%2C%22lastConsentTimestamp%22%3A%222025-12-08T04%3A04%3A51.185Z%22%2C%22expirationTime%22%3A1780891491185%7D; intercom-device-id-m6855w1q=8dbbc082-7040-4540-8495-a5fb08bd1ae6; AMP_dc8065a65e=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjIwZDA4MGJhYy0wZGZkLTQ0NmQtOGRjNC0zY2FlZTRjZjNmYzIlMjIlMkMlMjJ1c2VySWQlMjIlM0ElMjJ4aWFvZW4lNDBnbGFzc3dpbmcuY2xvdWQlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzcxMjk2ODk3NTc3JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc3MTI5NzA0Mjk3MyUyQyUyMmxhc3RFdmVudElkJTIyJTNBMTE1JTJDJTIycGFnZUNvdW50ZXIlMjIlM0EwJTdE; _cfuvid=9T.DQxm6YBrkQwnqSuc3idrmikA.zvIQtCUTRyuFoWM-1772065052043-0.0.1.1-604800000; fs_uid=#o-22FR2B-na1#dd317db9-d30d-4f1a-a6f9-8defeb71377a:fc51d7e3-b6d0-4d86-b807-1b2d7c8428da:1772059573561::21#/1802126959; fs_lua=1.1772069250019; _dd_s=aid=cb596b78-2de1-4d40-ac73-b9b12a0e99aa&logs=1&id=8e12423f-dda4-479e-bf35-f370d8555e18&created=1772069374505&expire=1772070289350&rum=2' \
  -H 'if-none-match: W/"936f225819f88344ec86ada0de2cf2c6"' \
  -H 'next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%22sign-in%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%2Ctrue%5D' \
  -H 'next-url: /sign-in' \
  -H 'priority: u=1, i' \
  -H 'referer: <https://app.integ.glasswing.cloud/sign-in>' \
  -H 'rsc: 1' \
  -H 'sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36'
Copy code
2:I[77349,[],"ClientPageRoot"]
3:I[65145,["1253","static/chunks/app/sign-in/page-c0093a8fefdc3c5c.js"],"default",1]
4:I[16157,[],""]
5:I[23841,[],""]
6:I[92485,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"default"]
7:"$Sreact.suspense"
8:I[271,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"ThemeSyncer"]
9:I[15051,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"TimezoneSyncer"]
a:I[57049,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"NavigateDialog"]
b:I[99251,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"ImpersonateHandler"]
c:I[13634,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"AppProvider"]
d:I[63477,["3477","static/chunks/3477-c478f8bfbce20dbb.js","9160","static/chunks/app/not-found-f2e082f1e2c0968e.js"],""]
e:I[7550,["7107","static/chunks/7107-cf1e9549417cce93.js","2143","static/chunks/2143-fb1672d73b583e12.js","8268","static/chunks/8268-7e3030e8e1b2f84b.js","3634","static/chunks/3634-4beefed73020550f.js","3185","static/chunks/app/layout-6ce3c7193d9e2c06.js"],"Toaster"]
0:["p3cnVIHez7uWCDcc_FyHw",[[["",{"children":["sign-in",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",true],["",{"children":["sign-in",{"children":["__PAGE__",{},[["$L1",["$","$L2",null,{"props":{"params":{},"searchParams":{}},"Component":"$3"}],null],null],null]},[null,["$","$L4",null,{"parallelRouterKey":"children","segmentPath":["children","sign-in","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/ba58a51ba384d627.css","precedence":"next","crossOrigin":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/_next/static/css/105d5ff4aa4f96a5.css","precedence":"next","crossOrigin":"$undefined"}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"min-h-screen overflow-hidden bg-background font-sans text-foreground antialiased __variable_09454f","children":["$","$L6",null,{"baseUrl":"<https://auth.app.integ.glasswing.cloud>","projectId":"P2y1kV1yOglxS9WdfX7F3zN9mRLd","refreshCookieName":"DSR_integration","sessionTokenViaCookie":{"sameSite":"Strict","cookieName":"DS_integration"},"children":["$","$7",null,{"children":[["$","$L8",null,{}],["$","$L9",null,{}],["$","$La",null,{}],["$","$Lb",null,{}],["$","$Lc",null,{"children":["$","$L4",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":["$","div",null,{"className":"h-screen w-full p-8","children":["$","div",null,{"className":"flex h-full flex-col items-center justify-center","children":[["$","h2",null,{"className":"text-4xl font-bold","children":"Not Found"}],["$","p",null,{"children":"We are sorry, but could not find requested resource."}],["$","$Ld",null,{"href":"/","className":"mt-4 underline","children":"Return Home"}]]}]}],"notFoundStyles":[]}]}],["$","$Le",null,{"position":"top-right","richColors":true}],null]}]}]}]}]],null],null],["$Lf",null]]]]
f:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1"}],["$","meta","1",{"charSet":"utf-8"}],["$","title","2",{"children":"Glasswing"}],["$","meta","3",{"name":"description","content":"Kubernetes optimization platform"}],["$","link","4",{"rel":"icon","href":"/favicon.ico","type":"image/x-icon","sizes":"125x125"}],["$","meta","5",{"name":"next-size-adjust"}]]
1:null
These are curl and response of the sign-in request
a
Hey @Xiaoen Tang, I think i see the problem. The redirect URL set in the console redirects to the sign in page. Have you pasted this URL from the google cloud console? You need to follow step 5 in this doc to correctly configure the redirect URL. this redirect URL has to be added to your google app as well
x
Hi @Atharva Joshi, thanks for your help. I've checked the redirect urls, they're the same on Goggle console and Descope console, and if I remove the sessionTokenViaCookie from AuthProvider and the session cookie renaming from the flow, I can be successfully redirected. The previous problem was when generating cookies for different environments with similar domains they will have conflicts, but the redirecting was working fine. The current problem is I tried to rename session cookies to resolve the conflict, but after doing that, the Frontend AuthProvider seems not recognising the newly named cookie anymore so it doesn't react after logging in anymore.
a
Just to rule this possibility out, can you confirm what route your app is designed to do when we access - https://app.integ.glasswing.cloud/ ? Currently when i access this im being redirected to the /sign-in route (although i see the sign in component because im unauthenticated). So im guessing theres something in the frontend code that is the problem. You could also provide a URL of a protected route in the console so it redirects inside the protected layer of your app.
x
The sign-in page route is set in the middleware, it was working fine if I don't rename the cookie, so I suppose it should be fine? The problem now is the renaming cooking doesn't work.
a
@Rahul Rijhwani @Akash Jivane can you assist here?
x
Hi @Atharva Joshi, thanks for all your help, I really appreciate it. I've put all the details and the investigation outcome into the support ticket. I will keep following that, please feel free to reach out if there is any other detail needed from my side. Thanks again, for all your efforts and time!
🙌 1
a
Looping in @Michael Rimboim here for more context
m
Hi @Xiaoen Tang, are you able to get a HAR capture from your redirect? Not sure if I missed it earlier in the conversation.
2 Views
Open in Slack
PreviousNext
Powered by