We are building a DXA 1.7 web app with SDL Web 8.5 and are incorporating the UGC functionality in it (using the UGC Microservices). Everything is working fine, a user can add a comment and see any comments posted to a Page or Component. However, what's not working is modifying your own comment.
By default, the UGC community microservice only allows editing a comment if you are the author of the comment.
It checks this in a claimprocessor, and this claimprocessor is verifying if the userid claim sent through the request corresponds to the userid of the comment as stored in the UGC database.
This is where our problem lies:
we have debugged our web app, and all relevant claims are transformed into a cookie with name TAFContext.1 and are added to the headers of the PUT request sent to modify a comment.
However, when debugging the microservice, we found that the request that arrives in the claimprocessor (PostAllowedByOwnerClaimProcessor) doesn' contain any cookies, so it just creates a new tracking id and user id, and as a result, the put operation is denied.
Could there be something we're missing in our microservice setup? or could there be a problem with the claimprocessor?
Everything works fine when we disable this claimprocessor, and use the PostAllowedByEveryoneClaimProcessor, but I feel this is a bit of a hack, and is not secure.
UPDATE
I've been digging some more, and i can confirm that the DXA webapplication sends a cookie containing the required claims. I did notice that this cookie starts with $version=1;TAFContext.1=xxxxxx (encrypted? cookie data).
Debugging the ugc microservice shows that, when the request contains this cookie, the TAFContext.1 cookie value is ignored.
Using Postman, I built a similar request, and get the same results when we add $version=1 to the cookie. However, when we remove this bit, then it TAFContext cookie seems to be recognized, and the comment is actually edited.
