问题

I am using the express-session module, it works perfectly on localhost but on my website (hosted on Heroku using Cloudflare), the express session is being blocked as being a third party cookie. Here is the configuration for my session:

app.use(session({
  resave: false,
  saveUninitialized: false,
  proxy : true,
  cookie: {
    maxAge: 3600000000000,
    httpOnly: false,
    secure: false,
    domain: '.mydomain.com',
    path: '/' 
  },  
  store: sessionStore,
  secret: 'mysecret',
  unset: 'destroy'
}));

Is this an issue with Express or maybe Cloudflare/Heroku?

回答1:

Why the cookie is blocked

From whatis.techtarget.com:

A third-party cookie is one that is placed on a user’s hard disk by a Web site from a domain other than the one a user is visiting.

As you mentioned in your comment, your client and your server are on different domains:
www.castcrunch.com is my client side server's URL and cast-crunch-server.herokuapp.com is my backend server URL

You can read more about cookie domains in the RFC 6265:

The Domain attribute specifies those hosts to which the cookie will be sent.

What you could do about that

As mentioned in this dzone article, you could use Json Web Tokens to do the authentication. Your server would send the token in the login response body, the client would store it and send it to the server in every subsequent request header.

The drawback with this approach, since you are storing the token, is that you would become vulnerable to XSS attacks. You have to pay special attention to that: sanitise all inputs, or better yet, use frameworks and languages that already to that.

Note: Of course, you could also uncheck the "block 3rd party cookies" option in the browser settings, but this does not seem like a long term solution :).

来源：https://stackoverflow.com/questions/42264821/why-is-express-session-cookie-being-blocked-as-a-third-party-cookie

标签

node.js