快速会话重置为每个请求

Question

I am trying to use session variables in express to manage user sign in. I can't get the variable to work over different requests. Here is my code:

var config = require('config'),

    ejs = require('ejs'),

    util = require('util'),

    express = require('express'),
    bodyParser = require('body-parser'),
    cors = require('cors'),
    moment = require('moment'),
    plaid = require('plaid'),
    mariadb = require('mariadb'),

    fs = require('fs'),
    http = require('http'),
    https = require('https'),

    session = require('express-session'),
    cookieParser = require('cookie-parser');

...

var app = express();

app.use(cookieParser());
app.use(
    session({
        resave: false,
        saveUninitialized: false,
        secret: 'debug',
        cookie: { secure: true }
    })
);

...

app.post('/tokensignin', function (req, res) {
    async function verify() {
        const ticket = await googleAuthClient.verifyIdToken({
            idToken: req.body.idtoken,
            audience: GOOGLE_AUTH_CLIENT_ID,
        });
        const payload = ticket.getPayload();
        const userid = payload['sub'];
        if (payload['aud'] == GOOGLE_AUTH_CLIENT_ID) {
            pool.getConnection().then(conn => {
                conn.query("CALL getUserByGoogleId(?)", [userid])
                    .then(rows => {
                        res.sendStatus(200);
                        if (rows[0]) {
                            req.session.test = "Hello, world!";
                            console.log("req.session.test = " + req.session.test);
                            req.session.user = {
                                firstName: rows[0].firstName,
                                lastName: rows[0].lastName,
                                avatar: rows[0].imageUrl,
                            };
                        } else {
                            conn
                                .query("CALL createUser(?,?,?,?,?)) VALUES (?,?,?,?,?)"
                                    , [userid, req.body.firstName, req.body.lastName, req.body.imageUrl, req.body.email]
                                )
                                .then(rows => {
                                    req.session.user = {
                                        firstName: rows[0].firstName,
                                        lastName: rows[0].lastName,
                                        avatar: rows[0].imageUrl,
                                    };
                                })
                                .catch(err => {
                                    console.log("error: " + err);
                                    res.send(err);
                                });
                        }
                    })
                    .catch(err => {
                        res.send(err);
                    });
                conn.end();
            });
        }
    }
    verify().catch(console.error);
});

The variables are properly stored the first time, but when I redirect to the home page, req.session.test and req.session.use are undefined.

Here's the code for that:

app.all('/home', function (req, res) {
    console.log("req.session.test = " + req.session.test);
    console.log(req.session);
    return res.render('home.ejs', {
        PLAID_PUBLIC_KEY: PLAID_PUBLIC_KEY,
        PLAID_ENV: PLAID_ENV,
        PLAID_PRODUCTS: PLAID_PRODUCTS,
        APP_MODE: config.APP_MODE,
        APP_PORT: config.APP_PORT,
        URL: config.URL,
        test: req.session.test,
        user: req.session.user,
    });
});

I'm using:

• Express 4.16
• express-session 1.15.6
• cookie-parser 1.4.3.

EDIT:

My website is using SSL, so my cookie should have secure:true .

UPDATE:

I tried moving res.sendStatus(200) so that the method now looks like this:

conn.query("CALL getUserByGoogleId(?)", [userid])
    .then(rows => {
        if (rows[0]) {
            req.session.test = "Hello, world!";
            console.log("req.session.test = " + req.session.test);
            req.session.user = {
                firstName: rows[0].firstName,
                lastName: rows[0].lastName,
                avatar: rows[0].imageUrl,
            };
        } else {
            conn.query("CALL createUser(?,?,?,?,?)) VALUES (?,?,?,?,?)"
                , [userid, req.body.firstName, req.body.lastName, req.body.imageUrl, req.body.email])
            .then(rows => {
                req.session.user = {
                    firstName: rows[0].firstName,
                    lastName: rows[0].lastName,
                    avatar: rows[0].imageUrl,
                };
            })
            .catch(err => {
                console.log("error: " + err);
                res.send(err);
            });
        }
        res.sendStatus(200);
        conn.end();
    })
    .catch(err => {
        res.send(err);
    });
});

and got the same result.

Answer 1

Try to change cookie: { secure: true } to false, because according to the Doc:

Note be careful when setting this to true, as compliant clients will not send the cookie back to the server in the future if the browser does not have an HTTPS connection.

Please note that secure: true is a recommended option. However, it requires an https-enabled website, ie, HTTPS is necessary for secure cookies. If secure is set, and you access your site over HTTP, the cookie will not be set.

Code:

app.use(
    session({
        resave: false,
        saveUninitialized: false,
        secret: 'debug',
        cookie: { secure: false }
    })
);