在 koa 服务器中检查日志时，不会从浏览器（本地主机）发送 cookie

Question

I use Koa for api server, React in frontend, and use Axios for xhr.

when client request to api server in server-side-rendering, which means in node.js, I can see all headers coming from node.js. when I test with PostMan, I see all the headers included in request also. However, when client get into CSR and do axios request, I couldn't see any headers from logs in api server except

{
  accept: 'application/json',
  'content-type': 'application/json',
  'user-agent': 'axios/0.19.2',
  host: 'localhost:5001',
  connection: 'close'
}

I could find cookies are included in request headers when check chrome inspector - network tab, but couldn't find why my localhost browser can't send headers with cookies appropriate.

for those who want to know how I setup both frontend and backend specifically,

Koa

app.use(cors({
  origin: verifyOrigin, // http://localhost:5000
  credentials: true,
}));

...

cookies.set("someCookieKey", someCookieValue, {
      httpOnly: true,
      maxAge: 1000 * 60 * 60 * 24 * 7,
    });

in React

const http = axios.create({
  baseURL,
  headers: {
    "Accept": "application/json",
    "Content-Type": "application/json",
  }
})

http.defaults.withCredentials = true;

Answer 1

After stumble upon on this for a while, I found I send request to server with out request object.

If api server deal with some business logic with cookies or header something, you better check client side omitted cookie or not.

Answer 2

Probably httpOnly: true is a problem in this case. That parameter blocks read cookie by js in browser. Try set value to false .