Cookie 设置到不同的域（Node.js、Angular）

Question

I am doing web app using Angular and Node.js (Express) and I have a problem with cookies - they are set into my backend domain instead of my frontend.

When I make a POST request to /auth endpoint , server will return HttpOnly cookies - one is JWT and the second is refresh token. When I inspect network tab in chrome, I can see that server sent these cookies back, but when I inspect Application > Storage > Cookies, nothing is here.

I find out, that cookies are set on my backend domain. (app-backend.com instead of app.com) They are just simply associated with my backend domain.

Wierd thing is, that my app is working just fine on my computer, but when I switch to my phone, cookies are not sent from there (I am using iPhone with Safari or Chrome). Also, when I ran my app on localhost dev server, everything worked aswell.

I tried to set domain in cookie config to my frontend domain, it is not working at all.

Also, Chrome warns me with this message, I don't know if it has anything to do with my problem

A cookie associated with a cross-site resource at "my-domain" was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure . You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032 .

Here is my code on github:

Frontend: https://github.com/TenPetr/dashboard

Backend: https://github.com/TenPetr/dashboard_backend

Thanks for your advices.

Answer 1

You are setting the SameSite=None; Secure SameSite=None; Secure attributes in your production.json which is correct. However, depending on your version of iOS / Safari you may be hitting an incompatibility issue where the cookies are incorrectly treated as SameSite=Strict .

In your development set-up you are both: not setting SameSite=None; Secure SameSite=None; Secure , and might be using URLs that count as the same site anyway, eg serving on localhost can lead to some weird cookie behaviour.

I would try testing your production configuration without the SameSite=None attribute. If this then starts to work on Safari, then you are hitting that bug. You can mitigate this by either setting two versions of the cookie, or adding useragent sniffing. There are more details on https://web.dev/samesite-cookie-recipes

Alternatively, you may be hitting Safari cookie policy issues if you are attempting to set cookies from the back-end server when it's not a site the user actually visits.