Authorization token in cookie

[RAUL2]

Hi Team,

I am getting a bearer token in httpOnly cookie from Single page application and want to validate it at Apigee side. This bearer token will also have data related to permissions.

1. How can I Extract bearer token from cookie in Apigee?

2. Is this good practice to fetch token from cookie?  I want to store this token locally so I want to keep it in cookie only.

Help me out

@anilsagar  need your suggestions help me out, Thanks in advance.

[dchiesa1]

I am getting a bearer token in httpOnly cookie from Single page application and want to validate it at Apigee side.

You can use the ExtractVariables policy to extract things out of a Header, like "Cookie". Check the documentation for how to use it. In the policy configuration, you can specify the source variable as request.header.cookie . If you show what the cookie looks like, someone (maybe me) might be able to make a detailed specific suggestion for the configuration of the policy.

Is this good practice to fetch token from cookie? I want to store this token locally so I want to keep it in cookie only.

For SPA, sure, that's an easy way to do it. The OAuth model recommends that tokens should be sent in the Authorization header, not in a Cookie. But for SPA it may be that the cookie is a nicer, easier way to manage and transmit the token.