2

I am trying to make a third party application meaning it will run across multiple domains. I want to handle a session per user that uses the app, therefore, I used the express-session module to make it but every time I make a request it starts up a new session for the current request...

const express    = require('express'),
      router     = express.Router();
      const session = require('express-session')

router.use(function(req, res, next) {
    res.header('Access-Control-Allow-Credentials', true);
    res.header('Access-Control-Allow-Origin', req.headers.origin);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
    res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept');
    next();
});

router.use(session({
    secret: 'keyboard cat',
    resave: true,
    maxAge: 2 * 60 * 60 * 1000, // 2 hours
    saveUninitialized: false,
    cookie: { 
        maxAge:  2 * 60 * 60 * 1000 ,
        secure: false,
        sameSite : false,
        httpOnly: false}
}))
router.get( '/',function (req, res, next) {

    // let payload = req.query;
    let isDevClient = req.session.isDevClient  || false;
    console.log('isNew? ', isDevClient );
    res.status(201).send({
        success: true, 
        isDevClient,
        message: 'msg..'
    });

}).post( '/',function (req, res, next) {
    let payload = req.body;
    console.log('isNew? ', req.session.isDevClient )
    req.session.isDevClient = true; 
    res.status(200).send({
        success: true, 
        message: 'ok'
    });
});


module.exports = router;

Request example

// javascript
fetch('https://127.0.0.1:8443/',{
method : "POST",
credentials: 'include',
})

//Jquery
    $.ajax({
        'type': 'post',
        'url': 'https://127.0.0.1:8443',
         'xhrFields': {
         'withCredential's: true
         }
        'success': function (response) {},
    })

``
ShobiDobi
  • 179
  • 1
  • 13
  • Are you sure that saveUninitialized should be false? I think that's the problem, because your session is not saved – Semyon Danilov Feb 24 '20 at 13:17
  • I have tried to make it true before it was the same as now... – ShobiDobi Feb 24 '20 at 13:23
  • How are you making the request? Provide a [mcve]. Do you see a `Set-Cookie` header in the response? Does the browser send the cookie in the next request? Look at the Network tab in your browser's developer tools. – Quentin Feb 24 '20 at 13:24
  • I make the request through a simple ajax or fetch. I see the `Set-Cookie` header in the `response header` at the network tad in chrome dev tools – ShobiDobi Feb 24 '20 at 13:28
  • Hey man did you ever figure this out? I'm running into same issue. – Andrew Venson Nov 13 '20 at 07:14

1 Answers1

-1

Use credentials: 'include' in your fetch call, otherwise fetch won't send cookies during cross-domain request. Example: 

fetch(..., {
   ...,
   credentials: 'include' 
}

Update: seems like recent Chrome version will not send cookies during cross-domain requests if SameSite attribute is not set.

Setting sameSite : 'none' should fix it. Note that chrome also requires these cookies to be Secure. https://www.chromestatus.com/feature/5633521622188032

By the way, you can easily provide examples with repl.it (like this)

Semyon Danilov
  • 1,753
  • 1
  • 17
  • 37
  • I have I used it will show an example on the original post – ShobiDobi Feb 24 '20 at 13:41
  • Ah, I guess you have a newer version of chrome, which doesn't send cookie if it has no SameSite attribute. I will update my answer – Semyon Danilov Feb 24 '20 at 13:47
  • 1
    I have changed the `sameSite : 'none'` on the server-side but it doesn't seem to work. – ShobiDobi Feb 24 '20 at 14:00
  • 1
    Did you notice the `Secure` part? It should be changed too – Semyon Danilov Feb 24 '20 at 14:03
  • yeah this is what i have now.. `router.use(session({ secret: 'keyboard cat', resave: true, maxAge: 2 * 60 * 60 * 1000, // 2 hours saveUninitialized: false, cookie: { maxAge: 2 * 60 * 60 * 1000 , secure: false, sameSite : 'none', httpOnly: false} }))` – ShobiDobi Feb 24 '20 at 14:06
  • Secure is set false in your case, but it must be true – Semyon Danilov Feb 24 '20 at 14:15
  • Made the change to `secure` true and yet it is the same as before – ShobiDobi Feb 24 '20 at 15:08
  • If you set `secure=true`, but are running on `HTTP` and not `HTTPS`, it will not work precisely because `secure=true`, but your connection is not. Therefore the cookies are not sent. If you want to use `SameSite=none` then you need `secure=true`, and since `secure=true`, then `HTTPS` is required. More info here: http://expressjs.com/en/resources/middleware/session.html – sboisse Sep 04 '20 at 00:58