Use auth cookie set by backend instead of jwt (fixes #2193)

[Nutomic]

I think #2193 happens because lemmy-ui still uses the jwt cookie while the backend automatically sets auth on login. So by switching lemmy-ui to the same cookie it should prevent the login error. Unfortunately I cant reproduce the problem locally so Im not certain.

Requires LemmyNet/lemmy-js-client#208

[dessalines]

You can use yalc publish --push to test lemmy-js-client changes locally, but I'll test this now.

[SleeplessOne1917]

I noticed that the path for the cookie that's set on the server side is /api/v3/user. Is it supposed to be that?

[Nutomic]

Im not setting any path, seems like the library or browser is doing it automatically. Should I change it to a different one?

Btw if there is an existing jwt cookie, lemmy-ui should change that to auth (with secure and httponly) so that users dont get logged out when their instance is upgraded. But not sure how to implement that.

[dessalines]

I've got this accounted for in #2210

Unfortunately we still have to use the manual set method for various reasons:

• The cookie from the server is a short-term session one, so we'd have to manually overwrite it anyway
• Tons of domain name problems with development if we try to read or set that cookie from the response headers, rather than the LoginResponse JSON.

[Nutomic]

We could also change how the cookie is set by the backend.

[dessalines]

I think session cookies are intened to expire right after you close that tab / app. But its probably better for clients / apps to decide their own expirations anyway, and if we do have any expiration, have it built into the JWT.

If we wanted to be consistent, I'd argue that maybe setting a cookie and JWT expiration of a year or so might be a good idea. Security ppl will hate that, but less-so than now.

[Nutomic]

I didnt know that there are so many different options for cookies. Should we get rid of the code that sets cookies in backend then?

[dessalines]

Tough call... I'd bring it up in one of the dev matrix chats. I do think it'd be much simpler tho to only support the Authorization Bearer header.

Applies to not just cookie setting, but cookie reading too.

[Nutomic]

I would still read the cookie for request auth besides the header, but only if it was explicitly set by the client.