Local development against a deployed Oathkeeper

[disambiguationuk]

We're running Oathkeeper within our dev environment to provide an ingress and auth for a number of secure endpoints. While developing our frontend locally using ory tunnel --dev we have Ory session tokens as a cookie however the cookie is scoped against the localhost domain so it won't get sent to our backend.

It feels like it should be a really simple case but I can't find any guidance on how we would develop against the deployed backend. I've tried using --cookie-domain with ory tunnel to set it to the subdomain Oathkeeper is on but then the ory api won't validate it. Any guidance on how we can progress on this would be much appreciated.

[vinckr]

Hello @disambiguationuk

When developing locally, Ory APIs must be exposed on the same domain as your application to avoid issues with third-party cookies. This is why you're seeing the Ory session tokens as a cookie scoped against the localhost domain. The Ory Tunnel is a development tool that allows you to expose the Ory APIs on your localhost domain. However, it's important to note that the Ory Tunnel should not be used in a production environment due to rate limiting and other issues [source].
If you're trying to develop against a deployed backend, you might want to consider using the Ory Proxy. The Ory Proxy is a reverse proxy deployed in front of your application that allows the Ory endpoints to be mirrored on the same domain as your app. It rewrites cookies to match the domain your application is currently on, which could help with your issue of the cookie being scoped against the localhost domain [source].
However, it's recommended to use a CNAME in production instead of the Ory Proxy. If you're developing locally but want to test against a deployed backend, you might need to set up a development environment that mirrors your production environment as closely as possible.
As for the --cookie-domain flag not working with the Ory API, it's hard to say without more information. It could be a configuration issue or a limitation of the Ory Tunnel. You might want to check the Ory Tunnel documentation for more information.
If you're still having trouble, please reach out to me on the Ory Community Chat