Javascript Express无法存储cookie

当用户通过用户名/护照登录时，我试图将登录会话存储到cookie中，以便服务器知道用户已登录。但曲奇永远不会被设定

以下是相关代码：

index.js:

if (process.env.NODE_ENV !== 'production') {
    require("dotenv").config();
}

const express = require("express");
const bodyParser = require("body-parser");

const app = express();
app.use(bodyParser.json({ limit: "16mb", extended: true }));
app.use(bodyParser.urlencoded({ extended: true, limit: "16mb" }));

const session = require("express-session");
app.use(
  session({
    secret: "thisIsMySecretMessageHowWillYouGuessIt",
    resave: true,
    saveUninitialized: true,
    cookie: {
        sameSite: 'none',
        httpOnly: true,
        secure: true
    },
  })
);

const passport = require("passport");
app.use(passport.initialize());
app.use(passport.session());

const cookieParser = require("cookie-parser");
app.use(cookieParser());

const cors = require("cors");

const whitelist = env.process.CLIENT_URL;
app.use(cors({ origin: whitelist, credentials: true }));

const cookieKey = "sid";
const md5 = require("md5");
const bcrypt = require("bcrypt");
const redis = require("redis");
const client = redis.createClient(process.env.REDIS_URL);
const cookieOption = { maxAge: 3600 * 1000, httpOnly: true, sameSite: 'none', secure: true};

login = async (req, res) => {
    const sessionKey = md5(
      getSecretMessage() + new Date().getTime() + user.username
    );

    client.hmset("sessions", sessionKey, JSON.stringify(user), function(err) {
      if (err) throw err;
    });

    // this sets a cookie
    res.cookie(cookieKey, sessionKey, cookieOption);   // expire after 60 mins

    res.send({ username: user.username, result: "success" });
};

isLoggedIn = async (req, res, next) => {
  if (
    (req.cookies === undefined || req.cookies[cookieKey] === undefined) &&
    !req.isAuthenticated()
  ) {
    res.sendStatus(401);
    return;
  }
};

auth.js:

if (process.env.NODE_ENV !== 'production') {
    require("dotenv").config();
}

const express = require("express");
const bodyParser = require("body-parser");

const app = express();
app.use(bodyParser.json({ limit: "16mb", extended: true }));
app.use(bodyParser.urlencoded({ extended: true, limit: "16mb" }));

const session = require("express-session");
app.use(
  session({
    secret: "thisIsMySecretMessageHowWillYouGuessIt",
    resave: true,
    saveUninitialized: true,
    cookie: {
        sameSite: 'none',
        httpOnly: true,
        secure: true
    },
  })
);

const passport = require("passport");
app.use(passport.initialize());
app.use(passport.session());

const cookieParser = require("cookie-parser");
app.use(cookieParser());

const cors = require("cors");

const whitelist = env.process.CLIENT_URL;
app.use(cors({ origin: whitelist, credentials: true }));

const cookieKey = "sid";
const md5 = require("md5");
const bcrypt = require("bcrypt");
const redis = require("redis");
const client = redis.createClient(process.env.REDIS_URL);
const cookieOption = { maxAge: 3600 * 1000, httpOnly: true, sameSite: 'none', secure: true};

login = async (req, res) => {
    const sessionKey = md5(
      getSecretMessage() + new Date().getTime() + user.username
    );

    client.hmset("sessions", sessionKey, JSON.stringify(user), function(err) {
      if (err) throw err;
    });

    // this sets a cookie
    res.cookie(cookieKey, sessionKey, cookieOption);   // expire after 60 mins

    res.send({ username: user.username, result: "success" });
};

isLoggedIn = async (req, res, next) => {
  if (
    (req.cookies === undefined || req.cookies[cookieKey] === undefined) &&
    !req.isAuthenticated()
  ) {
    res.sendStatus(401);
    return;
  }
};

req.cookies['sid']始终未定义，因此服务器将返回401状态

对于react客户端，“凭据”已设置为“包括”

我尝试过的事情：

if (process.env.NODE_ENV !== 'production') {
    require("dotenv").config();
}

const express = require("express");
const bodyParser = require("body-parser");

const app = express();
app.use(bodyParser.json({ limit: "16mb", extended: true }));
app.use(bodyParser.urlencoded({ extended: true, limit: "16mb" }));

const session = require("express-session");
app.use(
  session({
    secret: "thisIsMySecretMessageHowWillYouGuessIt",
    resave: true,
    saveUninitialized: true,
    cookie: {
        sameSite: 'none',
        httpOnly: true,
        secure: true
    },
  })
);

const passport = require("passport");
app.use(passport.initialize());
app.use(passport.session());

const cookieParser = require("cookie-parser");
app.use(cookieParser());

const cors = require("cors");

const whitelist = env.process.CLIENT_URL;
app.use(cors({ origin: whitelist, credentials: true }));

const cookieKey = "sid";
const md5 = require("md5");
const bcrypt = require("bcrypt");
const redis = require("redis");
const client = redis.createClient(process.env.REDIS_URL);
const cookieOption = { maxAge: 3600 * 1000, httpOnly: true, sameSite: 'none', secure: true};

login = async (req, res) => {
    const sessionKey = md5(
      getSecretMessage() + new Date().getTime() + user.username
    );

    client.hmset("sessions", sessionKey, JSON.stringify(user), function(err) {
      if (err) throw err;
    });

    // this sets a cookie
    res.cookie(cookieKey, sessionKey, cookieOption);   // expire after 60 mins

    res.send({ username: user.username, result: "success" });
};

isLoggedIn = async (req, res, next) => {
  if (
    (req.cookies === undefined || req.cookies[cookieKey] === undefined) &&
    !req.isAuthenticated()
  ) {
    res.sendStatus(401);
    return;
  }
};

在index.js和auth.js中翻转cookie选项中的“安全”值

使用“express samesite default”软件包

---

需要注意的一点是，该功能在半年前开始工作，可能有一些依赖项更新，因此它更改了cookie。

您可以使用本地存储。
本地存储保存在客户端设备上，并且可以使用

localStorage.getItem（'key'）

进行访问，您可以使用

localStorage.setItem>添加项（'key'，'value'）

我想这应该行得通。但是服务器如何判断请求是否被授权