6

I have a Node/Express application hosted on Heroku that has a domain that I purchased for it. When using the application on my desktop it works fine. I can log-in just fine when I visit it's domain at https://myapp.app or where it's hosted at on Heroku directly, https://myapp.herokuapp.com

However, when I visit the app on Safari on mobile iOS at it's domain ( https://myapp.app ) it won't authenticate requests. Logging in doesn't seem to set the cookie. When I visit the application at it's Heroku URL however ( https://myapp.herokuapp.com ) I can log in just fine. After logging in at https://myapp.herokuapp.com it'll let me stay logged in https://myapp.app, and only after logging in once already at https://myapp.herokuapp.com will it let me log in at https://myapp.app.

Here's my express-session code. I am using Passport.js for authentication as well.

app.use(session({ 
    secret: 'cat', 
    resave: false, 
    saveUninitialized: true,
    proxy: true,
    cookie: { 
        sameSite: 'none',
        secure: process.env.NODE_ENV == "production" ? true : false
    }
}));

Any help would be greatly appreciated.

Chris MacSwan
  • 61
  • 3
  • 1
    Have you tried out this: https://stackoverflow.com/questions/7834228/set-cookie-for-domain-instead-of-subdomain-using-nodejs-and-expressjs ? – Tin Nguyen Feb 27 '20 at 07:52
  • This happens since safari considers `sameSite: None` as `sameSite: strict` – Joshua Varghese Mar 21 '21 at 15:48
  • Pls is there any other solution you might suggest, am facing this issue and none of the answer above are working for me. @TinNguyen – Paulliano Sep 30 '22 at 11:52

2 Answers2

0

This is working for me:

app.use(
  session({
    name: SESS_NAME,
    resave: false,
    saveUninitialized: false,
    store: new MongoStore({mongooseConnection: db}),
    secret: SESS_SECRET,
    proxy: true,
    cookie: {
      maxAge: 1000 * 60 * 24, // 24 hours
      secure: true,
      httpOnly: true,

    },
  })
);
Jonas
  • 47
  • 6
0

Since you are setting sameSite: 'none', you are telling express session that you will be working with cross-domains. Setting sameSite: true should work for you or since this is its default value, you do not need to use it

Kotai
  • 121
  • 1
  • 7