Client issue with Cloudflare (bot management)

[DerrickMartinez]

/api/v1/enrollment/create_device will return a cookie, for example:

defguard_proxy=ABCD1234; Expires=Tue, 04 Feb 2025 22:37:57 GMT

But running through cloudflare, it will set a second cookie, i.e.

set-cookie: __cf_bm=doJLB55tYR_sq26VsCzp9JkRSoxGZr6KxSes1ILLo3c-1738708077-1.0.1.1-61526ibFeVTYxR_jeYMZt1PfbQtRz82H1Krnt1qx3rPvsLldvpIABCmK97eLQOe28Z0W8KXgjewU7YLFxNqU.g; path=/; expires=Tue, 04-Feb-25 22:57:57 GMT; domain=.skyslope.com; HttpOnly; Secure; SameSite=None

The issue is that the client is sending the __cf_bm cookie in the following /api/v1/enrollment/create_device request, not defguard_proxy, causing the request to fail.

Since the code is expecting a string (single cookie) and not an array it fails.

For example, maybe something like this:
let authCookie = res.headers['set-cookie']; if (Array.isArray(authCookie)) { // Find the cookie that starts with "defguard_proxy=" authCookie = authCookie.find(cookie => cookie.startsWith("defguard_proxy=")); }