Node.js 快速会话在 HTTP 上正常，session 未在 Z0E8433F9A404F1F3BA21Z01C 中恢复

Question

I am running a node.js with working Passport.js "local", "facebook" and "google" authentication. I use express-session with MongoDB as store, everything works like a charm: session is persisted upon successful authentication, cookie in the browser, sent by axios and session is recovered as I come back.

If however I move to https, my session cannot be recovered. I can login, see my session in the mongoDB, see my cookie in the browser, but the session is not pulled and nothing is in req.user.

My code looks pretty much "common" for what I can read on the web, cannot see anything obviously different of missing:

const dotenv = require('dotenv');
const express = require('express');
const app = express();
const https = require('https');
var fs = require('fs');
const cors = require('cors');
const session = require("express-session");
const bodyParser = require("body-parser");
const passport = require('./passport/passport');

const authRoutes = require('./routes/auth');
const userRoutes = require('./routes/user');
const ensureAuthenticated = require('./middlewares/auth/ensureAuthenticated');
const ensureAuthorized = require('./middlewares/auth/ensureAuthorized');

const connectMongoDb = require('./mongoDb/connectMongoDb');
const mongoose = require("mongoose");
const MongoStore = require('connect-mongo')(session);

dotenv.config();

connectMongoDb();

app.use(bodyParser.json());

app.use(bodyParser.urlencoded({ extended: true }));

app.use(cors({
    origin: `${process.env.CLIENT_HOST_URI}:${process.env.CLIENT_PORT}`,
    credentials: true
}));

app.use(session({
    secret: process.env.SESSION_COOKIE_SECRET,
    resave: false,
    saveUninitialized: false,
    store: new MongoStore({ mongooseConnection: mongoose.connection }),
    cookie: { maxAge: 24 * 60 * 60 * 1000 }
}));

app.use(passport.initialize());

app.use(passport.session());

app.use('/api/auth', authRoutes);

app.use('/api/user', ensureAuthenticated, userRoutes);


https
    .createServer({
        key: fs.readFileSync('server.key'),
        cert: fs.readFileSync('server.cert')
    }, app)
    .listen(process.env.API_SERVER_PORT, () => {
        console.log(`Server has started on port ${process.env.API_SERVER_PORT} over HTTPS`);
    });

I suspect this might be linked to the self-signed certificate I am using. But... I cannot believe I should deploy and get a real certificate to get this work on my laptop in dev mode.

I also wonder if there is any log that could tell me what goes wrong.

Thank you for you help, David

Answer 1

I found what the issue was. In my case at least.

I spotted this from chrome:

This led me to add the following attribute in the cookie config object:

sameSite: 'None',

Once this change implemented, I saw this other message in chrome:

This worked and the reason why it initially complained is probably because I was running my frontend/client from

http://localhost:3000

and my backend/api from

https://localhost:4000

... so strictly put, different hosts.

My cookie config then becomes:

cookie: {
        secure: true,
        sameSite: 'None',
        maxAge: 24 * 60 * 60 * 1000
    }

Hope this helps the community.