节点 js express-session Set-Cookie on Postman/不在 Flutter http 标头中

Question

I'm facing an issue trying to connect an flutter application with my nodejs backend with express-session. In postman the response header includes a "Set-Cookie"-Header, but the flutter headers with http.post(...) do not: headers: {content-length: 113, content-type: application/json; charset=utf-8} {content-length: 113, content-type: application/json; charset=utf-8} .

I need a cookie to keep the authenticated session with passport. Any ideas how to fix it?

Flutter headers: host: '127.0.0.1:3000', connection: 'keep-alive', 'content-length': '57', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36', 'content-type': 'application/json; charset=utf-8', accept: '*/*', origin: 'http://localhost:51879', 'sec-fetch-site': 'cross-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:51879/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7' host: '127.0.0.1:3000', connection: 'keep-alive', 'content-length': '57', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36', 'content-type': 'application/json; charset=utf-8', accept: '*/*', origin: 'http://localhost:51879', 'sec-fetch-site': 'cross-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:51879/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7'

Postman Headers: 'content-type': 'application/json', accept: '*/*', 'postman-token': '7c79280d-****-****-a985-c01395e50e08', host: 'localhost:3000', 'accept-encoding': 'gzip, deflate, br', connection: 'keep-alive', 'content-length': '66'

Answer 1

Recommend you to use dio library for HTTP calls.

import 'package:dio/dio.dart';

class ApiProvider {
  Dio _dio;
  String aToken = '';

  final BaseOptions options = new BaseOptions(
    // base url to backend server
    baseUrl: 'http://a.b.c.d:port/',  
    connectTimeout: 15000,
    receiveTimeout: 13000,
  );
  static final ApiProvider _instance = ApiProvider._internal();

  factory ApiProvider() => _instance;

  ApiProvider._internal() {
    _dio = Dio(options);
    _dio.interceptors.add(InterceptorsWrapper(
        onRequest:(Options options) async {
          // to prevent other request enter this interceptor, 
          // use a new Dio(to avoid dead lock) instance to request token.
          _dio.interceptors.requestLock.lock();
          
          // set the cookie to headers
          options.headers["cookie"] = aToken;

          _dio.interceptors.requestLock.unlock();
          return options; // continue
        }
    ));
  }

  Future login() async {
    final request = {
      "userName": "",
      "password": "",
      "token": ""
    };
    final response = await _dio.post('/login', data: request, options: Options(
        followRedirects: false,
        validateStatus: (status) { return status < 500; }
    ));
    //get cooking from response
    final cookies = response.headers.map['set-cookie'];
    if (cookies.isNotEmpty && cookies.length == 2) {
      // it depends on how your server sending cookie
      aToken = cookies[1].split(';')[0];
    }
  }

  /// if we call this function without cookie then it will throw 500 err.
  Future getSomething() async {
    final response = await _dio.post('/something');
  }
}