我有一个使用Express的节点应用程序,我试图为我的客户机设置一个cookie。它在本地环境(HTTP)上工作得很好。但一旦我投入生产(https),我就可以很好地接收cookie(我可以在响应中看到它),但它没有被设置。有什么想法吗?
NGNIX CONF:
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
gzip on;
server {
listen 443 ssl default_server;
listen [::]:443 default_server;
server_name back.domain.com;
ssl_certificate /etc/letsencrypt/.../fullchain.pem;
ssl_certificate_key /etc/letsencrypt/.../privkey.pem;
location / {
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
}
}
节点应用程序:
const api = express()
api.enable('trust proxy')
api.use(cors({origin: 'https://front.domain.com', credentials: true}))
api.post('/login', (req, res) => {
// validate credentials and generate token
// set expires to 24h
res
.cookie('token', token, {expires, httpOnly: true, secure: true})
.sendStatus(204)
})
前面:
// I use the axios lib
axios({
baseURL: 'https://back.domain.com',
url: '/login',
withCredentials: true,
method: 'POST'
}