Using Cookies with 'websocket' transport

[adamlwgriffiths]

I know this has been asked a thousand times, and I've tried my best to avoid asking but I just can't piece together enough information together to get this working.

I'm using python-socketio for my server, and the javascript socketio library for my client.
I'm wanting to create and store a user_id to remember users as the SID is 100% ephemeral and doesn't survive even a page refresh.

I've set the cookie parameter of AsyncServer to a dictionary.
Eg.

cookie = {
    'name': 'sid',
    'Expires': 'Mon, 31 Dec 2022 00:00:00 GMT',
    'SameSite': 'Strict',
}

1. When using the 'websocket' transport, the cookie doesn't appear.
   When reverting to 'polling', I can see the cookie echoed back in the "connect" handler's environ["asgi.scope"]["headers"].

Then when going back to 'websocket', the cookie is sent to the server (I can see it in the environ printout).
But the server is no longer able to modify the cookie.

Does the 'websocket' transport support setting cookies?

2. Looking at the engine.io code, it only supports making 1 Set-Cookie header.
   Ie. you are limited to setting a custom name whose value is the current SID, and nothing more.
   For this to do anything more, the cookie value would have to be a list of dictionaries.

As the SID passed to the server on connect is the SID from the previous session, it seems that it could be used to tie a new session to the last. But that then flows into my next point

3. The SID stored in the cookie is the value present in the polling query string, but it differs from the SID passed to the socketio event handlers:

INFO:     127.0.0.1:44590 - "GET /ws/socket.io/?EIO=4&transport=polling&t=O5mc7gC HTTP/1.1" 200 OK
event="connect"
sid="cgkKI2SLKhEq7t0mAAAL"
headers={
        ...
	cookie = sid=zXeNguEHf_2-YkKAAAAI
}
INFO:     127.0.0.1:44590 - "POST /ws/socket.io/?EIO=4&transport=polling&t=O5mc7gK&sid=kRwmjopPIDuzt-B3AAAK HTTP/1.1" 200 OK
INFO:     127.0.0.1:44604 - "GET /ws/socket.io/?EIO=4&transport=polling&t=O5mc7gM&sid=kRwmjopPIDuzt-B3AAAK HTTP/1.1" 200 OK
event="event"
sid="cgkKI2SLKhEq7t0mAAAL"

Note the difference between my custom printed "sid=..." and the sid in the query string.

It seems I need to add custom events for setting/querying the cookies from the client rather than trying to make the above work?

As an aside, it seems chrome doesn't show websocket cookies?
I don't see them in chrome's Javascript panel under session, local storage, or cookies.
This SO post seems to suggest this is a chrome behaviour.
I've found this quite misleading. I'm not sure if anyone else has come across this.

[miguelgrinberg]

You are trying to do something that cannot be done. Cookies can only be set when there is an HTTP response. Websocket doesn't have that, so it has no way to deliver a cookie to the browser.

[adamlwgriffiths]

It seems that way.
There's just lots of strange docs that hint its sort of possible.
https://socket.io/how-to/deal-with-cookies
https://socket.io/docs/v4/server-api/#event-initial_headers
https://python-socketio.readthedocs.io/en/latest/api.html#asyncserver-class=

And it kind of works if you're not using websocket.

It all just lead me up the garden path.

[miguelgrinberg]

Cookies can only be set when you use long polling. As I said above, it is not possible for WebSocket clients, and for that reason it is not considered a widely used option. In most cases you'll find that any necessary cookies are set in an HTTP exchange before the Socket.IO connection is made.

[creatormir]

In a WebSocket handshake, you can set a cookie without any problems. If you need to do this later, then you either need to make additional HTTP/GET requests to set the cookie from the server, or set the cookie via JS/WebSocket
Example of setting cookies for aiohttp

async def websocket_handler(request):
    ws = web.WebSocketResponse()
    
    #  set cookie when shaking hands
    ws.set_cookie('name', 'value', path='/', expires=None, domain=None, max_age=86400*30, secure=True, httponly=True, version=None, samesite='None')

    await ws.prepare(request)

    async for msg in ws:
        if msg.type == aiohttp.WSMsgType.TEXT:
            if msg.data == 'close':
                await ws.close()
            else:
                await ws.send_str(msg.data + '/answer')
        elif msg.type == aiohttp.WSMsgType.ERROR:
            print('ws connection closed with exception %s' %
                  ws.exception())

    print('websocket connection closed')
    return ws```