CSRF problem for local running SPA in test environment

[LandSprutte]

Hi all,

I have an issue when running an application (A) trying to authenticate through our test environment, when using custom-ui flows. Our custom-ui flows are hosted on auth.test.my-domain.com and it works perfectly fine in when I try to, say login through another app (B) on any giving sub-domain (e.g. app.test.my-domain.com), but when I try tunnel my to login from (A) running on localhost I get CSRF.

Not sure if anyone else has this issue, maybe it is some configuration I am missing? :)

Any help is appreciated

[vinckr]

You are using Ory Kratos (which version) or Ory Network? What command are you using to run the tunnel?

Please include as much information as possible, ideally also some steps to reproduce from a fresh install. CRSF could have a many different reasons and its really hard to tell which it can be from your brief description.

This might help: make sure you're consistently using either localhost or 127.0.0.1, but not both interchangeably, as they're considered different domains by browsers.

[LandSprutte]

Fair enough :)

Currently the workflow looks like this.

Trying to add authentication to my vite-app via OIDC-flow. I want to tunnel to my test environment (ory project with a staging-tag), which is hosted on test.auth.my-domain.com.

ory tunnel http://localhost:5173 -- dev --project <my-test-environment-project-id>

And this works as id expect if I use default Branding -> UI Urls from the console. (e.g https://<my-test-environment-project-slug>/ui/login)

But as soon as I change the UI Urls to be hosted on a different domain than: https://<my-test-environment-project-slug>/ui/xxx, say to test.auth.my-domain.com/login. I receive a CSRF error when I try to get any flow via the flowId generated from my locally running vite-app: https://test.auth.my-domain.com/self-service/login/flows?id=<id-from-vite-app>

I assumption is that when i use the tunnel, it only accepts cookies from https://<my-test-environment-project-slug> domain and not
https://test.auth.my-domain.com but I may very well be wrong.

I have tried illustrating my what I am trying to do. Let me know If you need more context :)