# Http-request, cookies for different domains in one flow

**URL:** <https://discourse.nodered.org/t/http-request-cookies-for-different-domains-in-one-flow/40636>\
**Category:** General\
**Created:** [8 February 2021 22:22 UTC](https://discourse.nodered.org/t/http-request-cookies-for-different-domains-in-one-flow/40636 "2021-02-08T22:22:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marooned](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marooned/32/2858_2.png) [@Marooned](https://discourse.nodered.org/u/Marooned)\
**Post date:** [8 February 2021 22:22 UTC](https://discourse.nodered.org/t/http-request-cookies-for-different-domains-in-one-flow/40636/1 "2021-02-08T22:22:46Z")

</div>

Hi  
After a few days, dozens of attempts and checking all forum/google results I could find I decided to ask here for some help.

I try to get some data from a page (`myedenred.pl`, employee benefit prepaid cards). There are a few steps to get to final JSON I would like to grab.

1. login form on `https://myedenred.pl/` (with CSRF token)
2. it sets cookie `PHPSESSID` for domain `myedenred.pl`
3. now the fun begins - clicking on `card lists` we get call to `https://myedenred.pl/login/cardholder?redirect=%2F%23%2Fcards` which redirects us to `https://twojakarta.edenred.pl/api/oauth/start?redirect=%2F%23%2Fcards` - notice subdomain `twojakarta.edenred.pl`
4. `https://twojakarta.edenred.pl/api/oauth/start?redirect=%2F%23%2Fcards` redirects us to `/api/oauth/token` **AND** sets the cookie `PHPSESSID` for domain `twojakarta.edenred.pl` (it has different value from the one from point 2.)
5. `https://twojakarta.edenred.pl/api/oauth/token` redirects us to `https://myedenred.pl/login/authorize?type=web_server&client_id=2&redirect_uri=https%3A%2F%2Ftwojakarta.edenred.pl%2Fapi%2Foauth%2Ftoken&response_type=code&scope=`
6. above redirects us to `https://twojakarta.edenred.pl/api/oauth/token?code=<some-token>&redirect=%2F%23%2Fcards`
7. above redirects us to `/api/oauth/start`
8. above redirects us to `/#/cards`
9. finally `https://twojakarta.edenred.pl/#/cards` sets cookie `XSRF-TOKEN`

From now on there are several requests that return JSONs, like:  
10. `https://twojakarta.edenred.pl/ajax/ngData/users/loggedInData` (with cookie `PHPSESSID` from point 4. and `XSRF-TOKEN` from point 9. - also, `X-XSRF-TOKEN` header is set with the same value)  
11. `https://twojakarta.edenred.pl/ajax/ngData/cards/list_all` - similar data as in 1. - this JSON is the one I'm interested in

Now, after this quite long and boring introduction lets move to Node-RED. I have a set of http-request nodes trying to follow above path. First one for point 1. for login, I get proper cookie but then I'm not sure how the cookies are handled for different domains. Should I store `PHPSESSID` aside and replace `msg.cookies` every time I call different domain? Points 3. to 8. are done in one http-request, I get 5 elements array in `redirectList`, but those cookies are not preserved. I've tried to manually extract them like `msg.cookies['PHPSESSID'] = msg.redirectList[1].cookies['PHPSESSID'];` but that didn't work and looks like ugly hack rather than proper approach.

Calling those final endpoints from point 10. and 11. that should returns JSON fails and I get error `Login required` so I assume it does not get proper cookie (I tried to send both `PHPSESSID`, no luck).

My flow is quite messy right now and has lots of debug code so I'm not posting it. It's also pointless without credentials so..

Anyway, long story short. Some hints on handling different subdomains with different cookies (with the same name) would be much appreciated.  
Thanks

---

<div class="post-metadata">

**Author:** ![Marooned](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marooned/32/2858_2.png) [@Marooned](https://discourse.nodered.org/u/Marooned)\
**Post date:** [29 March 2021 11:21 UTC](https://discourse.nodered.org/t/http-request-cookies-for-different-domains-in-one-flow/40636/2 "2021-03-29T11:21:55Z")

</div>

So maybe I'll try to simplify the question.  
Can we handle cookies for different (sub)domains in one flow when response redirects us to those subdomains?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [28 May 2021 11:22 UTC](https://discourse.nodered.org/t/http-request-cookies-for-different-domains-in-one-flow/40636/3 "2021-05-28T11:22:31Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.