6 replies

Zero Trust Application communication

Hi all, I have a question regarding the Applications talking to each other.
I have two applications, with the same access policies. This means, when a user successfully authenticates on either application, they can access the other as well. Since a global cookie gets stored in the team domain, this seems to work perfectly. However:

The applications are set-up as follows:

(app1) path: example.com/manage/* (=frontend)
(app2) path: example.com/api/* (=backend)

When the user successfully authenticates on app1, they can succesfully access app2 manually.

Successfully authenticating on the front-end (

app1

app1

) essentially means the user can access the api (

app2

app2

) without any issue. However, my frontend is dynamic, so when a delete button or such is pressed, it will send out a request to the api. Whenever this happens, the api responds with its login page, as to make the user reauthenticate, even though the user is authenticated already. When opening the same link to the api in a tab manually, no reauthentication is necessary, and the request gets fulfilled.

My first thought was that this was an issue regarding cookies, but I can't seem to solve the issue. Given the two applications are on the same domain, I don't see how the cookies wouldn't be "shared".

Any ideas would be greatly appreciated NotLikeThis