II have an exppress app witch works correctly in dev. However, when i do try to set cookies in prod, cookies are visible in network tab, but do not present in the browser. I did a research and i think i covered most common problems, still cookies are not set You may see my express app I do add express configuration file, which i post here as well

         const app = require("express")();
            require("./config/express")(app);
            app.disable("x-powered-by");
            app.use((req, res, next) => {
              res.setHeader("Access-Control-Allow-Origin", "example.com");
              res.setHeader("Access-Control-Allow-Methods", "POST,GET,OPTIONS");
              res.setHeader("Access-Control-Allow-Headers", "*");
              res.setHeader("Access-Control-Allow-Credentials", true);
              res.setHeader(
                "Access-Control-Allow-Headers",
                "Origin, X-Requested-With, Content-Type, Accept"
              );
            
              if (req.method === "OPTIONS") {
                // return res.sendStatus(200);
              }
              next();
            });
//express config.js
         const express = require("express");
            const path = require("path");
            const cookieParser = require("cookie-parser");
            const bodyParser = require("body-parser");
            const jwt = require("express-jwt");
            const jwks = require("jwks-rsa");
            const cookieSecret =
              process.env.COOKIESECRET ||
              "aabbcc";
            // const { errorHandler } = require('../utils')
            const expressSession = require("express-session");
            const config = require("../config/config");
            const helmet = require("helmet");
            const morgan = require("morgan");
            
              app.use(express.json());
              app.use(bodyParser.json());
              app.use(bodyParser.urlencoded({ extended: true, limit: "50mb" }));
            
              app.use(cookieParser()); // TRY to use it with secret as in the __express.js file
              app.use(express.static("uploads"));
              app.use(express.static(path.join(__dirname, "static")));
              app.use(express.static(path.resolve(__basedir, "static")));
              app.use("/static/uploads", express.static("static/uploads"));
              app.use("/files", express.static("files"));
              app.use(helmet());
              app.use(morgan("combined"));
            
              // app.use(errorHandler(err, req, res, next));
                 app.use(
                    expressSession({
                      secret:
                        "aabbcc",
                      resave: false,
                      saveUninitialized: true, cookies,
                      cookie: { secure: true, sameSite: "none", domain: 'example.com' }, 
                    })
                  );
                  app.set("trust proxy", 1);
                };

     const expiryDate = new Date(Date.now()   60 * 60 * 1000);
     res.cookie(authCookieName, token, {
                                          expires: expiryDate,
                                          httpOnly: true,
                                          secure: true,
                                          domain: "example.com",
                                        });
    
                                        res.cookie(secondCookieName, secondToken, {
                                          expires: expiryDate,
                                          httpOnly: true,
                                          secure: true,
                                          domain: "example.com",
                                        });
    
                                        res.status(200).send(user).end();
                                        return;

CodePudding user response：

After some research, it appeared, that this is the problem here

This Set-Cookie was blocked because its Domain attribute is invalid with regards to the current host URL This is seen as message in the response-headers.

But i do set all domains correcty. I tried with https as well as without it

Does any ever had the same problems?

PS : Both Front end and back end run on subdomains of a main domain

backend.maindomain.com - my backend frontend.maindomain.com - my frontend

maindomain.com - landing page from witch you are rediirected to the app front end if you want to use it

CodePudding user response：

Solved!

It appears you need to set the main domain name as domain and cookies are being set on each subdomain