代码之家  ›  专栏  ›  技术社区  ›  soywod Ronnie Smith

未使用node+express+nginx设置cookie

  •  0
  • soywod Ronnie Smith  · 技术社区  · 6 年前

    我有一个使用Express的节点应用程序,我试图为我的客户机设置一个cookie。它在本地环境(HTTP)上工作得很好。但一旦我投入生产(https),我就可以很好地接收cookie(我可以在响应中看到它),但它没有被设置。有什么想法吗?

    NGNIX CONF:

    http {
      include mime.types;
      default_type application/octet-stream;
      sendfile on;
      keepalive_timeout 65;
      gzip on;
    
      server {
        listen 443 ssl default_server;
        listen [::]:443 default_server;
        server_name back.domain.com;
    
        ssl_certificate  /etc/letsencrypt/.../fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/.../privkey.pem;
    
        location / {
            proxy_pass http://localhost:5000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_cache_bypass $http_upgrade;
        }
      }
    }
    

    节点应用程序:

    const api = express()
    
    api.enable('trust proxy')
    api.use(cors({origin: 'https://front.domain.com', credentials: true}))
    
    api.post('/login', (req, res) => {
      // validate credentials and generate token
      // set expires to 24h
    
      res
        .cookie('token', token, {expires, httpOnly: true, secure: true})
        .sendStatus(204)
    })
    

    前面:

    // I use the axios lib
    axios({
      baseURL: 'https://back.domain.com',
      url: '/login',
      withCredentials: true,
      method: 'POST'
    }
    
    1 回复  |  直到 6 年前
        1
  •  0
  •   soywod Ronnie Smith    5 年前

    经过数小时的研究我发现…我必须设置 domain 关键 domain.com 当我创建cookie时:

    res
      .cookie('token', token, {expires, httpOnly: true, secure: true, domain: 'domain.com'})
      .sendStatus(204)