1

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS

I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https)

This app should be able to grant access to multiple files from salesforce.com to cloudfront using cloudfront signed cookies.

To do this, i've thought about building an aws lambda function exposed as a web-service from api gateway that will generate and return back the signed cookies in a HTTP Response Header to the js app.

Then, the salesforce js app should be able to call this function to fetch the signed cookies and redirect the user to the private content url on cloudfront.

So far, i've built a s3 bucket + a cloudfront distibution + lambda function linked to a api gateway. But i'm unable to make them work together and set the signed cookies on the browser because of cookies same origin policy :

  • The function that generates the cookie is hosted on amazonws.com (Lambda function)
  • The function that call the amazonws.com function is hosted on salesforce.com
  • salesforce.com makes a XHR request using CORS to amazonws.com to get required cookies.
  • For each returned cookie, amazonws.com set the attributes below:
    • domain=cloudfront.net; path=/; secure; httpOnly

I successfully fetch the cookies on the client side (salesforce.com) from server side (amazonws.com) by reading the XHR HTTP Response header .

But (and this is where i've spent the last 24 hours), the cookies are not set in the cookie store of the browser on salesforce.com. Which means they are not available for requesting resources to cloudfront.net.

Do you think that could work if my aws lambda function was on the same domain as cloudfront.net to serve a cookie with domain=cloudfront.net :

  • awmazonws.com/myfunction would become cloudfront.net/myfunction

Or is there any other way to do this?

Thanks a lot for your support!

Attached is a simple diagram to illustrate my use case

Improve this question
1
  • are you sending JSON? if so, just wrap your existing response with an outer object that has the cookies and other meta as object keys instead of using the "transport layer".
    – dandavis
    Commented Aug 16, 2018 at 18:36

2 Answers 2

Reset to default
2

The domain attribute of for a cookie cannot be set to arbitrary domains. While foo.example.com could set a cookie to example.com it could not set a cookie to example.org since this is an unrelated domain. From MDN:Set-Cookie: Invalid Domains:

A cookie belonging to a domain that does not include the origin server should be rejected by the user agent.

As for how to achieve what you want: it is not clear what you want to achieve in the first place. Cookies for cloudfront.com should only be given by cloudfront.com server. Maybe you are trying to do something with cookies were cookies where never designed for.

Improve this answer
7
  • First Thank you @Steffen for your reply. What i'm trying to do is accessing private contents from cloudfront.net using signed cookies (docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…). According to their documentation, the server requesting the private resources should set 3 cookies for the request to succeed. So if i understand well, server a.com should set 3 httpOnly cookies on with domain=cloudfront.net so that cloudfront could grant access to user asking for private contents from the browser.
    – Brice
    Commented Aug 16, 2018 at 18:12
  • @Brice: I have no experience with cloudfront but the specification regarding cookies is quite clear that you cannot set a cookie for an unrelated domain. This means the cookie for cloudfront.com must be set by cloudfront.com and cannot be set by s3.amazonws.com.
    – Steffen Ullrich
    Commented Aug 16, 2018 at 18:24
  • i've been through this specification but i'm not sure it can be applied in my case. As i said i'm able to see the cookies in the http response header eventhought they are not present in the browser cookies storage. Plus cloudfront is not an hosting server but just a CDN that grant access to contents so it's not possible to set cookies from this domain. What i'm doing is building a serverless app that will fetch cookies to a third party server (ie: AWS lambda function) with cloudfront domain and then use thoses cookies to access to cloudfront secured resources.
    – Brice
    Commented Aug 16, 2018 at 18:45
  • @Brice: your question if it is possible to set cookies for an unrelated domain was answered (no, it can't) - which is the only security relevant aspect here. As for how to achieve what you are trying to do you might better ask at stackoverflow.com. And it would probably be a good idea to add more context to a question you ask there, i.e. not only describe what you technically tried but also what you ultimately want to achieve with your attempts - because maybe the correct way to achieve this is different from what you tried.
    – Steffen Ullrich
    Commented Aug 16, 2018 at 18:56
  • Ok i'm editing my question with more details, hoping that will help to better understand my use case.
    – Brice
    Commented Aug 17, 2018 at 10:46
1

For those trying to access a protected resource in CloudFront from a different domain you can not set the cookies cross domain so you're limited to using Signed URLs instead. However you can use javascript on the CloudFront site to use the parameters in the Signed URL to create a Signed Cookie directly in CloudFront. I put together a simple JS script that does just that.

aws-signed-cookie-from-signed-url.js

  • build signed url in www.mysite.com that points to CloudFront url www.cloudfronturl.com/sample/index.html
  • included the JS in the CloudFront resource "sample/index.html"
  • upon the user using the signed URL, index.html will create the SignedCookie which will allow all additional navigation within www.cloudfronturl.com/sample to work based on the cookie
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .