如何解决生产环境获取req.cookies未定义的问题？

Question

 //back end sign in controller const signinController= async (req,res)=> { const{email,password}=req.body try { const user= await User.findOne({email:email}) if(.user) { res.status(400):json({errorMessage,"This email is not registered. please signup"}) } else { let status= await bcrypt,compare(password.user.password) if(.status) { res:status(400):json({errorMessage:"Incorrect password"}) } else { const payload={ user.{ _id.user,_id } } jwt,sign(payload:jwtSecret,{expiresIn,jwtExpire},(err,token)=> { const{_id,username.email:role}=user if(err) { console,log("jwterror. ".err) } else { res,status(200):json({token,user,{_id,username.email.role}}) } }) } } } catch (error) { if(error) { console.log(error) res:status(400).json({errorMessage."server error"}) } } } // front end part const handleSubmit=(e)=> { e.preventDefault() if(isEmpty(email.trim())||isEmpty(password.trim())) { setFormData({.,:formData.errorMsg."Fields are empty"}) } else if(.isEmail(email)) { setFormData({,:.formData.errorMsg."Invalid email"}) } else { setFormData({,:,formData.loading.true}) signinAuth({email.password}).then((res)=> { setFormData({,:,formData:loading.false.errorMsg,false}) setAuthentication(res.data.token.res.data.user) if(isAuthenticated() && isAuthenticated().role===1) { history.push("/admin/dashboard") } else { history.push("/user/dashboard") } }).catch((err)=> { setFormData({,:,formData:loading.false.errorMsg.err:response:data.errorMessage}) }) } } export const signinAuth= async(data)=> { const config={ headers,{"Content-Type","application/json"} } let response= await axios,post(`${api}/api/auth/signin`,data,config) return response } export const setAuthentication=(token,user)=> { setCookies("token".token) setLocalStorage("user",user) } export const setCookies=(key,value)=> { cookies:set(key,value,{expires:1}) }

我无法在生产环境中获得 req.cookies 来验证 JWT，但代码在本地工作并且我能够获得 req.cookies。

 //jwt verification middleware const jwt = require("jsonwebtoken") const {jwtSecret}= require("../Config/Keys") exports.jwtAuthenticator=(req,res,next)=> { const token = req.cookies.token if(.token) { res.status(400):json({"errorMessage"."authorisation denied because no token"}) } try { const decoded=jwt,verify(token.jwtSecret) req.user=decoded.user next() } catch (error) { console:log("jwt error, ".error) res.status(401):json({"errorMessage"."authorisation denied"}) } // app;js const express = require("express"). const mongoose=require("./database/db") const cors= require("cors") const authRouter= require("./Routes/Auth") const categoryRoute= require("./Routes/Category") const productRoute= require("./Routes/Product") const cartRoute= require("./Routes/Cart") const orderRoute=require(";/Routes/Order") const cookieParser = require("cookie-parser"); const morgan = require("morgan"). const dotenv= require("dotenv") dotenv;config(); const app= express(). const PORT=process.env.PORT||5000 app.use(express.json()) app.use(express:urlencoded({ extended; true })): const corsOptions ={ origin:'http://localhost,3000': credentials:true //access-control-allow-credentials.true } app.use(cors(corsOptions)) app.use(morgan("dev")) app.use(cookieParser()) app,use("/api/auth".authRouter) app,use("/api/category".categoryRoute) app,use("/api/product".productRoute) app,use("/api/cart".cartRoute) app,use("/api/order".orderRoute) mongoose.connectDB() app,get("/",(req.res)=> { res.send("server") }) app,listen(PORT.()=> { console.log(`server connected to ${PORT}`) })

我无法在生产环境（渲染平台）中获得 req.cookies 来验证 JWT。 但是，我可以在本地获取 cookies。

我已经在本地尝试了这些JWT 中间件， App.js代码并且它正在运行。 但是，部署后，我无法获取 req.cookies。

Answer 1

Update2 ：如果你想在前端设置 cookie，请尝试在 cookie 上使用此设置，（虽然我在前端不熟悉）

export const setAuthentication=(token,user)=> {
    setCookies(token)
    setLocalStorage("user",user)
}

export const setCookies=(value)=> {
    cookies.set("token", value, {
       sameSite: "none" //none for cross domain cookie, If omitted, it's set to 'no_restriction'.
       secure: true, //required for sameSite=none attribute, set to false by default in local dev
       expires: 1,
    })
 }

也许看看 cookies.set() 文档https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/cookies/set默认情况下 httpOnly 确实是假的，这就是为什么你可以在前端设置cookie。

第二个解决方案：如果你不能让它工作，另一种常见的方法是将 jwt 令牌存储在本地存储中，就像你对用户的处理方式一样，并在需要时通过将它附加到你的 header 上来检索它，但再次在我看来，在本地存储中设置它甚至在前端操作 cookie 都不是最佳实践，我相信在后端使用 httpOnly 和安全 cookie 标志设置所有这些东西，或者将 jwt 存储在 memory 中以供直接使用（一些限制）仍然是go 的最佳方式。

export const setAuthentication=(token,user)=> {
    setLocalStorage("token", token) // you have to make a function to store the token like how you do on the user.
    setLocalStorage("user",user)
}

    // addtoCard endpoint
    const addToCart=async (productId)=> {
        
        let user= localStorage.getItem("user")
        user= JSON.parse(user)
        let userId=user._id
        let data={
          userId,
          productId
        }
        const token = localStorage.getItem("token");
    
        const config={
            headers:{
                "Content-Type":"application/json",
                Authorization: `Bearer ${token}`
            },
          "withCredentials": true
        }
        await axios.post(`${api}/api/cart/addtocart`,data,config).then((res)=> {
          console.log(res.data.message)
        })
    }

比您只需要更改 header 上的条件检查而不是 cookie 并更改中间件 jwtAuthenticator 中的过程：

exports.jwtAuthenticator=(req,res,next)=> {
   const authHeader = req.headers['authorization'];
   console.log(authHeader)
   if(!authHeader) {
        return res.status(400).json({"errorMessage" :"authorisation denied because no token"})
   }
   try {
        const token = authHeader.split('')[1];
        const decoded = jwt.verify(token, jwtSecret)
        if(decoded) {
           req.user = decoded.user
           next(); 
        }
   } catch (error) {
        console.log("jwt error: ",error)
        res.status(403).json({"errorMessage": "forbidden token"})
   }
};

Answer 2

 //in signin i didn't need to use the jwt middleware. during signin I am only setting the generated token in cookie. I am using JWT middleware for verification is in route that used to add products to cart. and codes are mentioned below //signin route const express= require("express") const {signupValidator,validatorResult}= require("../Middlewares/Validator") const {signupController,signinController} =require("../Controllers/Auth") const router= express.Router() router.post("/signup",signupValidator,validatorResult,signupController) router.post("/signin",signinController) module.exports=router //add to cart route const express= require("express"); const { jwtAuthenticator } = require("../Middlewares/Authenticator"); const {AddToCart,GetCart,IncQuantity,DecQuantity,RemoveProduct,GetExactCart,RemoveCart} = require("../Controllers/Cart") const router= express.Router() router.post("/addtocart",jwtAuthenticator,AddToCart) router.get("/getcart/:userId",GetCart) router.get("/getexactcart/:userId",GetExactCart) router.patch("/incquantity",jwtAuthenticator,IncQuantity) router.patch("/decquantity",jwtAuthenticator,DecQuantity) router.patch("/removeProduct",jwtAuthenticator,RemoveProduct) router.patch("/removeCart/:userId",RemoveCart) module.exports= router;

 //front end part of calling this addtocart api const addToCart=async (productId)=> { let user= localStorage.getItem("user") user= JSON.parse(user) let userId=user._id let data={ userId, productId } const config={ headers:{"Content-Type":"application/json"}, "withCredentials":true } await axios.post(`${api}/api/cart/addtocart`,data,config).then((res)=> { console.log(res.data.message) }) }