How to access client cookie (with session ID) created by node.js Express?

Question

I thought I understood how Cookies worked, but I guess not since I'm stuck on the following:

I cannot display a cookie with document.cookie, testing with alert(document.cookie); in my code.

I am playing around with node and have the following code snippet up on my server (everything else works and serving pages with Express):

var express = require('express')
, util = require('util')
, MemoryStore = express.session.MemoryStore
, app = express.createServer()
, sessionStore = new MemoryStore();

app.configure(function() {
    app.set('views', __dirname + '/views');
    app.set('view engine', 'ejs');
    app.use(express.logger());
    app.use(express.cookieParser());
    app.use(express.bodyParser());
    app.use(express.methodOverride());
    app.use(express.session({ 
            store: sessionStore, 
            secret: 'BBQ12345AHHH',
            key: 'cookie.sid' }));
    app.use(app.router);
    app.use(express.static(__dirname + '/public'));
    });

On my server, I see a cookie being sent when I hit index.ejs. Chrome also shows a cookie being sent in the header on index.ejs. However, when I add alert(document.cookie) in the of the index.ejs page, the alert is blank. What am I doing wrong?

Thanks

score 10 · Accepted Answer · edited May 17 '16 at 12:00

10

The Connect session cookies default to httpOnly which Chrome respects, I.E. the cookies are inaccessible by client side javascript.

A session cookie doesn't need to be read by client side javascript, unless it's by malicious XSS scripts so it's all good.

If you wanna override it though, try:

app.use(express.session({ 
  store: sessionStore, 
  secret: 'BBQ12345AHHH',
  cookie: {httpOnly: false},
  key: 'cookie.sid' }          
))

Source http://www.senchalabs.org/connect/session.html#session

edited May 17 '16 at 12:00

Munawir

3,346
9
33
51

answered May 06 '12 at 22:36

Esailija

138,174
23
272
326

so how can Node access a signed cookie later in the app? – vsync Aug 04 '13 at 23:16
1

@vsync first result on google for "signed cookie" `req.signedCookies['name']` – Esailija Aug 04 '13 at 23:25
10x. it's best all the information will be here, in one place, instead of evil Google :) but when I read a signed encrypted cookie, does the server knows how to decrypt it using the same key? – vsync Aug 05 '13 at 19:21

score 0 · Answer 2 · answered May 06 '12 at 22:28

0

Are you calling up the cookie right? I found this page helpful when i was learning:

http://www.quirksmode.org/js/cookies.html

answered May 06 '12 at 22:28

PitaJ

12,969
6
36
55

How to access client cookie (with session ID) created by node.js Express?

2 Answers2