# Read http only cookie server side

**URL:** <https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115>\
**Category:** Questions\
**Tags:** phoenix, cookie, http-only\
**Created:** [March 5, 2024, 6:44pm UTC](https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115 "2024-03-05T18:44:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kokolegorille](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/kokolegorille/32/4784_2.png) [@kokolegorille](https://forum.elixirforum.com/u/kokolegorille)\
**Post date:** [March 5, 2024, 6:44pm UTC](https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115/1 "2024-03-05T18:44:04Z")

</div>

Hello everyone,

I am trying to read a cookie I put on the connection after login. I set it like this…

```elixir
  defp put_refresh_cookie(conn, token) do
    conn
    |> put_resp_cookie("refresh", token, sign: true, http_only: true, secure: true, max_age: 604800)
    # |> put_resp_cookie("refresh", token, sign: false, http_only: true, secure: true, max_age: 604800)
  end

```

and I try to read it back in a refresh action of an API controller with…

```elixir
refresh_cookie = conn.req_cookies["refresh"]

```

If I use sign: false in put\_resp\_cookie, I can read it back without problem. With sign: true, the value is not equivalent

How can I read it back when using sign: true?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![al2o3cr](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/al2o3cr/32/3457_2.png) [@al2o3cr](https://forum.elixirforum.com/u/al2o3cr)\
**Post date:** [March 5, 2024, 7:13pm UTC](https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115/2 "2024-03-05T19:13:29Z")

</div>

The trick is mentioned in the docs for `put_resp_cookie` - the corresponding `fetch_cookies` call needs to [specify which cookies are signed/encrypted](https://hexdocs.pm/plug/Plug.Conn.html#put_resp_cookie/4).

For instance, here’s a spot that does it in `phx.gen.auth`’s code:

> <https://github.com/phoenixframework/phoenix/blob/546ee2fe67f418e2e1e9886cfa37e7b7e48e0bc5/priv/templates/phx.gen.auth/auth.ex#L101>

---

<div class="post-metadata">

**Author:** ![kokolegorille](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/kokolegorille/32/4784_2.png) [@kokolegorille](https://forum.elixirforum.com/u/kokolegorille)\
**Post date:** [March 5, 2024, 7:20pm UTC](https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115/3 "2024-03-05T19:20:14Z")

</div>

Thank You for your response…

I saw this fetch\_cookies and used this code

```elixir
conn = fetch_cookies(conn, signed: ~w(refresh))
refresh_cookie = conn.req_cookies["refresh"]
IO.inspect refresh_cookie, label: "COOKIE"
TokenHelpers.verify_token(refresh_cookie)
|> IO.inspect(label: "VERIFY")

```

But it does not seems to return the same value as passed, and when I verify the token, it fails

This is the token I pass

```elixir
TOKEN: "SFMyNTY.g2gDdAAAAAJ3AmlkbQAAACRmYWMyZWU2MC0wMjRkLTQwOWItYmYxNi1kMTUxNmI4ZmFhNTl3BG5hbWVtAAAABWFkbWlubgYAUnkQEI4BYgABUYA.P0wcEGTxqV5_X-7JDOybsJ1oVzXfsFc2erYPKVxH7_g"
VERIFY: {:ok, %{id: "fac2ee60-024d-409b-bf16-d1516b8faa59", name: "admin"}}

```

This is the value I receive as the cookie

```elixir
AFTER COOKIE: "SFMyNTY.g2gDbQAAAKNTRk15TlRZLmcyZ0RkQUFBQUFKM0FtbGtiUUFBQUNSbVlXTXlaV1UyTUMwd01qUmtMVFF3T1dJdFltWXhOaTFrTVRVeE5tSTRabUZoTlRsM0JHNWhiV1Z0QUFBQUJXRmtiV2x1YmdZQVVua1FFSTRCWWdBQlVZQS5QMHdjRUdUeHFWNV9YLTdKRE95YnNKMW9Welhmc0ZjMmVyWVBLVnhIN19nbgYAUnkQEI4BYgAJOoA.anW9pNkQ8yNy_bzRYl2RyKtIU2w_F2z1by9JfV8n-eo"
VERIFY: {:error, :invalid}

```

I will look at the phx.gen.auth code to see how they do

---

<div class="post-metadata">

**Author:** ![kokolegorille](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/kokolegorille/32/4784_2.png) [@kokolegorille](https://forum.elixirforum.com/u/kokolegorille)\
**Post date:** [March 5, 2024, 7:29pm UTC](https://forum.elixirforum.com/t/read-http-only-cookie-server-side/62115/4 "2024-03-05T19:29:54Z")

</div>

I need to get the cookie like this

```elixir
refresh_cookie = conn.cookies["refresh"]

```

and not like this…

```elixir
refresh_cookie = conn.req_cookies["refresh"]

```

I thought it would be the same, but it’s not.

Thank You for the help