Not able to authenticate second time

[orthosie]

@osiset

Thanks for the awesome package. We have installed the app and made a couple of additional route that are accessed through a navbar inside the app. One of the authenticated route is declare like this

Route::group(
    ['prefix' => 'product',  'middleware' => ['throttle']], function () {
      Route::get('/add', function() {
              return view('message',['message' => "Product add"]);
      })->middleware('auth.shopify')->name("product.add");
});

And the view blade file looks likes this

@extends('layouts.app')

@section('content')    
  <!-- You are: (shop domain name) -->  
    <p>You are: {{ Auth::user()->name }}</p>
    <p>Message from the god: {{ $message  }}</p>
@endsection
      
@section('scripts')
    @parent   
              
    <script type="text/javascript">
        var AppBridge = window['app-bridge'];
        var actions = AppBridge.actions;
        var TitleBar = actions.TitleBar;
        var Button = actions.Button;
        var Redirect = actions.Redirect;
        var titleBarOptions = {
            title: 'Welcome',
        };    
        var myTitleBar = TitleBar.create(app, titleBarOptions);
    </script>
@endsection   

The app is installed and being tested as a private app. The initial authenticated default welcome page shows up and the very first time when /product/add is clicked from the nav the authentication is done properly the expected messages shows up correctly. But when the /product/add is clicked again "Osiset\ShopifyApp\Exceptions\MissingShopDomainException" is being thrown. It seems the authentication flow is not happening after the first time. The same happens if we click on the home second time as well.

What are we missing?

[gnikyt]

Cookie issues. Are you on v16? I've added code to help with some of this.

[orthosie]

We are using v16. Still the same issue.

[orthosie]

Setting same_site to none in config/session.php fixed the issue. I think due to embedded nature the third party cookies are rejected with lax / strict setting. SESSION_SECURE_COOKIE should be set to true as well.

[gnikyt]

These values get set with the cookie helper code, but doesnt always work yes, good idea to directly change it.