重定向到新的子域并在重定向的子域上设置 cookie

Question

Express: 4.x

NodeJS: 12.x

On a.example.com I have a GET listener that redirects to b.example.com and sets a cookie on b.example.com .

app.get('/foo', (req, res) => {
    res.cookie('name', 'foo', { domain: '.example.com', path: '/', secure: true })
    res.cookie('age', '21', { domain: '.example.com', path: '/', secure: true })
    res.redirect(302, 'https://b.example.com');
})

But none of the cookies are set in b.example.com . What am I missing here?

Answer 1

Ok, So I figured out the answer by playing around with the res.cookie options. If anybody comes upon this, here is the right configuration.

Set the httpOnly flag to false if your client javascript application is required to read the cookies.

res.cookie('user', 'foo', { path: '/',  domain: '.example.com',  httpOnly:false secure: false  })
res.cookie('age', '21', { path: '/',  domain: '.example.com', httpOnly:false, secure: false  })
res.redirect('https://b.example.com');

Answer 2

If you are checking for this locally, ie on http ://localhost, you wont see secure cookies.