Kintone.proxy and secure cookies

General
1

Question / Problem

I'm calling an external API that uses cookie-based session authentication via kintone.proxy(). The login endpoint responds with a Set-Cookie header, but the cookie never seems to actually get stored in the browser. Because of this, my follow-up requests have no session cookie and the my server treats me as unauthenticated.

Current Situation

Kintone App has a JS customization on the Record Edit screen - I'm calling an external API that logs in a user to our server, and then does some authenticated calls.
The API works fine when tested in Postman

Code / Attempts

// Step 1: Login — expecting Set-Cookie in the response 
kintone.proxy('https://api.example.com/login', 'POST', {'Content-Type': 'application/json'}, { username: 'user', password: 'pass' }).then(function(resp) { console.log(resp[2]); 

// Step 2: Authenticated call — cookie is never sent 
kintone.proxy('https://api.example.com/data', 'GET', {}, {}).then(function(resp) { console.log(resp[0]); // returns 401 Unauthorized });

Error Message

none just no cookie.

Desired Outcome / Expected Behavior

Is there a way to to specify to pass along the cookie?

2

Hello @Revotech

Based on the behavior you described, this appears to be a limitation of kintone.proxy() rather than an issue with your login API.

As noted in the Kintone documentation, when kintone.proxy() is used to call an external API, cookies that would normally be generated at the API destination are not automatically generated. Because of this, a Set-Cookie response from your login endpoint will not create a browser session that is automatically included in the next kintone.proxy() request.

I would recommend using an authentication method that can be explicitly included in each request, such as a token or other request-header-based authentication, rather than relying on cookie-based session authentication.

I hope this helps.