setcookiesamesitecookie-session

Express module cookie-session not including SameSite and Secure in Response Set-Cookie

Seen this before here, but I've seen no real resolution. The server's Node Express express-session module OR cookie-session module sends back a Session Cookie, but as I had not coded in the SameSite/Secure attributes, they are not there and do the client on a subsequent POST to the server fails as Not Logged In, with a 403. As expected.

First, my client logs in to the server successfully: enter image description here

Here is the corresponding server code, using express-session: enter image description here

enter image description here

Which produced a Session Cookie via the Set-Cookie. NOTICE the SameSite='none' and Secure=true attributes were not included, and as expected, not there. enter image description here

enter image description here

Now, I have added the sameSite and secure attributes to the session object and run the Login again.

enter image description here

Lets look at the Response Headers returned from this Login, with the attributes added to the session object. Not only do we not see the attributes on the Set-Cookie Response Header, but there is NO cookie returned! enter image description here

It appears that when these 2 attributes are added to the session object in either express-session or cookie-session that the result is no cookie is returned. The meaning being that a subsequent POST to the server will return a 403, User Not Logged In.

I'm really stumped. I've spent a LOT of time on this! Thank you for ideas and help.

Solution

  • You seem to be misusing the cookie-session middleware. The cookieSession function takes an JavaScript object but the documentation doesn't mention any cookie field in that object.

    Anything specified in a cookie field is ignored by the middleware and has no effect on the resulting cookie; the only reason your cookie ended up being flagged HttpOnly is that it's the middleware's default behaviour.

    Instead, all the cookie attributes should be specified in a "flat" object, like so:

    app.use(cookieSession({
  name: 'session',
  secret: secret,
  domain: 'chicagomegashop.com',
  sameSite: 'none',
  secure: true,
  httpOnly: true
}));

    However, you have another issue. If I'm interpreting your screenshots correctly, you seem to attempt to set a cookie with a Domain attribute of chicagomegashop.com in a response from https://paylivepmt.com. That cannot work; browsers will ignore such a Set-Cookie response header:

    The user agent will reject cookies unless the Domain attribute specifies a scope for the cookie that would include the origin server.