I have one really simple Express back-end with express-session and I want to do some cross origin request. My back-end is hosted on my local : http://localhost:8080 and my front-end is hosted on https://example.com (with SSL). When I made a GET request from https://example.com to http://localhost:8080 the session is not saved, but when I made a request from http://localhost:8081 to http://localhost:8080 (with my front-end deployed locally without SSL) it works
How can I fix this issue with front-end hosted on my domain ?
Back-end:
var express = require('express');
var session = require('express-session');
var app = express();
app.use(function (req, res, next) {
res.header('Access-Control-Allow-Credentials', true);
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept');
if ('OPTIONS' == req.method) {
res.send(200);
} else {
next();
}
});
app.use(session({secret: "thisismysecrctekeyfhrgfgrfrty84fwir767", cookie: {httpOnly: true} }));
app.set("trust proxy", 1);
app.disable('etag');
// Status
app.get('/auth', function (req, res) {
console.log(req.session)
if(!req.session.key)
{
req.session.key = 2;
req.session.save()
res.send('<html>COOKIE just saved</html>');
}
else
res.send('<html>COOKIE saved</html>');
});
app.listen(8080, function () {
console.log('Auth listening on port 8080!')
});
Front-end:
<html>
<script src='https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js'></script>
<script type='text/javascript'>
const instance = axios.create({withCredentials: true});
instance.get('http://localhost:8080/auth').then(function (response) {console.log(response.data);})
</script>
</html>
We can see a difference with the cookie headers, but it's the same front-end code and same back-end, only the host change. A cookie is passed when the front-end is on local, not when it`s hosted with a domain:
Network info hosted front-end on domain : Network info hosted front-end on domain
Network info local front-end : Network info local front-end
I'm using CloudFlare proxy
Thanks a lot!
