Proper ways to send/parse cookies when redirecting

[lacostej]

I am implementing an openId connect login mechanism that uses redirections across domains.

I haven't found a way to get it to work with http_party without reimplementing the redirection handling mechanism so that for each request I can

• send the cookies specific to the domain I am redirecting to
• capture the cookies for that particular domain

Code example

      uri = 'xxxxxx'
      headers = {.....}
      host = ""
      loop do
        if uri.start_with? "/"
          uri = host + uri
        else
          require 'uri'
          u = URI.parse(uri)
          host = u.scheme + "://" + u.host
        end
        response = self.class.get(uri, headers: headers.merge({
          'Cookie' => to_cookie_string(uri), # required to send the cookies for that domain
        }), follow_redirects: false)
        parse_cookie(response)  # required to parse the cookies for that domain
        if [301, 302, 303].include? response.code
          uri = response.headers['Location']
          next
        end
        break if response.code == 200
      end

    # implemented using http_cookie as it seems to be better at managing multiple domains
    def to_cookie_string(uri)
    end
    def parse_cookie(response)
    end

Is there a better way to do this?

[lacostej]

@jnunemaker some thoughts about this?

[jnunemaker]

Hi @lacostej. I'm sorry but I don't have any thoughts. I wrote the redirection stuff but I didn't write the cookie part and have never used it. 🤭 I was hoping someone else might hop in.