如何从 cookies 获取使用“httpOnly: true”发送的数据？

Question

In backend, the cookies are sent as below:

    jwt.sign(
      payload,
      process.env.JWT_SECRET,
      { expiresIn: 31556926 },
      (err, token) =>
        res
          .cookie("token", token, {
            httpOnly: true,
            maxAge: 31556926,
          })
          .json({ success: true, newUser })
    );

But in frontend, I cannot get the "token" from cookies.

It is not shown in Chrome, and it is said that it is because Chrome doesn't set cookies in localhost.

I tried to use console.log(document.cookie); to print it, but nothing showed up in console, and I think it is because the httpOnly is set to be ture so the cookies are invisible from document.cookie ?

Then how can I get this "token" from cookies? I need to send it back (through socket.io) to backend for authentication.

Thanks!

Answer 1

Cookies set with the HttpOnly flag are not accessible from JavaScript.

But cookies in general are sent to the setting server with every request. Once the server instructs your browser to store the cookie, the browser will send back the contents in the Cookie header of the request.

Based on your code snippet above, it looks like you're using Express. To access the token from the server

const cookieParser = require('cookie-parser'); // Don't forget to npm install
app.use(cookieParser()); // Before any routes that use the cookie

/* from inside your route handler */
    req.cookies.token